Hi:

In the packet filter live log I see numerous "default drop" coming from various IP's with a source port (not destination) of tcp 80. I did some googling, and it seems that is some web pages trying to do things like load balancing, etc. Not sure if that's correct or not.

But - anyone else getting a lot of those default drops?

Second - is there a way to creat a packet filter based on a source port rather than a destination port? Or, do a forward for a certain source port and send it to a black hole?

Thanks !!

What are you trying to achieve? (normally source ports are random.)

__________________

• R.T.F.M. – A hitchhiker's guide to IT
  
• How To Ask Questions The Smart Way
  
• My Astaro Feature Requests

Running Astaro ASG virtual appliance | Home power user v8.0xx
Intel Dual Core 2.4GHz (800MHz) | 4GB (2 x 2GB) PC2-6400 800Mhz 5-5-5-18 | WD 160GB |3 x Intel Pro/1000
GPG Key Fingerprint: 2220 44E7 2E1A 5288 F81D 4B21 029F 8626 4A88 779E

First, I'm trying to make sure this isn't some sort of attack.

Assuming it's not (it comes from multiple IP's), I just don't want it to be cluttering up the logs.

Yes, usually you would see a random source port and a destination of 80 for HTTP traffic. This is the opposite. Always a source port of 80 and random destination ports.

The destination IP is the external IP of the firewall (shown as X.X.X.X below).

11:40:52 Default DROP TCP 65.125.72.43 : 80
→ X.X.X.X: 46414
[RST] len=40 ttl=59 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:1a:8c:17:1c:01


11:40:52 Default DROP TCP 208.43.57.101 : 80
→ X.X.X.X: 39128
[ACK] len=52 ttl=50 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:1a:8c:17:1c:01


11:40:52 Default DROP TCP 208.43.57.101 : 80
→ X.X.X.X: 39128
[ACK] len=52 ttl=50 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:1a:8c:17:1c:01


11:40:53 Default DROP TCP 208.43.57.101 : 80
→ X.X.X.X: 39128
[ACK] len=52 ttl=50 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:1a:8c:17:1c:01


11:40:54 Default DROP TCP 208.43.57.101 : 80
→ X.X.X.X: 39128
[ACK] len=52 ttl=50 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:1a:8c:17:1c:01


11:40:55 Default DROP TCP 64.94.107.14 : 80
→ X.X.X.X: 44912
[RST] len=40 ttl=51 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:1a:8c:17:1c:01

Yes, you should be able to create a packet filter rule to silently drop inbound traffic from port 80.

Create a new Service destination call it R_HTTP (Reverse HTTP)
and set the Source Port as 80 and the destination as 1:65535.
The normal HTTP definition is Source 1:65535, Destination: 80

Create a packet filter rule:
Source: Any
Service: R_HTTP
Destination: External Address
Action: Drop
Log Traffic: Unchecked

I'm not sure hot it will treat normal HTTP traffic, but try it out. ASG normally just drops this traffic as a part of IPTABLES since it isn't a part of reply to an outbound request.

Someone check my math here.

__________________
Thanks, JimmyM
ASG 8.000: Jetway J7F2WE1G Mini-ITX, 512MB RAM, AD3RTLANP, 40GB SATA

Thanks.

Duh - right under my nose.

Created it like you said. Put it at the bottom of the packet filter stack.
No more source port 80 swamping the logs.
Tried outgoing http, and seems to be working fine, and incoming http to the one allowed server is also working.

Thanks!!

Ah, Very good. Glad to help.

__________________
Thanks, JimmyM
ASG 8.000: Jetway J7F2WE1G Mini-ITX, 512MB RAM, AD3RTLANP, 40GB SATA