I can't access my webadmin from some computers, and the connection is extremely slow. I check packet-filter log, and there's so many IP-Spoofing Block in it.
2004-Jan 29 14:30:42 (none) kernel: IP-SPOOFING Drop: IN=eth1 OUT= MAC=ff:ff:ff:ff:ff:ff:00:05:5d:4d:88:85:08:00 SRC=192.127.0.173 DST=192.127.0.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=48939 PROTO=UDP SPT=137 DPT=137 LEN=58
2004-Jan 29 14:30:43 (none) kernel: IP-SPOOFING Drop: IN=eth2 OUT= MAC=ff:ff:ff:ff:ff:ff:00:05:5d:4d:88:85:08:00 SRC=192.127.0.173 DST=192.127.0.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=49195 PROTO=UDP SPT=137 DPT=137 LEN=58
2004-Jan 29 14:30:43 (none) kernel: IP-SPOOFING Drop: IN=eth1 OUT= MAC=ff:ff:ff:ff:ff:ff:00:05:5d:4d:88:85:08:00 SRC=192.127.0.173 DST=192.127.0.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=49195 PROTO=UDP SPT=137 DPT=137 LEN=58
I have enable some rules like this:
any-netbios-any-Drop
any-any-external_broadcast_-Drop
any-any-internal_broadcast_-Drop
Is this rules is right ? Up till now, I still can access my webadmin from my computer, I have to access from another computer, and when I can access it, the asl keep blocking our connection, sometimes we can surf internet, sometimes we cant. And right now, we can't access the mail-server that have the same subnet with proxy... how weird.. Hopw someone can give me some clue for this.

regards,

Hi Reyman,
please block also netbios at the external interface.
There are enough boxes outside which will have netbios enabled...
Your log say spoofing. Look at your cabling and your IP-Adresses. It seems to me that you have an box with an IP-Address which is normaly in the range of the internal network at your external Interface connected.
When this box is on, the internet connection is broken?
-->So there is the error.

HTH

Best Regards

[ QUOTE ]
Hi Reyman,
please block also netbios at the external interface.
There are enough boxes outside which will have netbios enabled...


[/ QUOTE ]
Ok, I will, untill I can access my asl from my other computer [img]/images/graemlins/smile.gif[/img] Thanks..

[ QUOTE ]

Your log say spoofing. Look at your cabling and your IP-Adresses. It seems to me that you have an box with an IP-Address which is normaly in the range of the internal network at your external Interface connected.
When this box is on, the internet connection is broken?
-->So there is the error.


[/ QUOTE ]
Mmm.. my firewall box have 3 interface, wich each of them connect to the same hub that also have cables connection from Internal network. Is it the main error why there's a lot of 'IP-Spoof eth=1, eth=2' ?

regards,

Hi reyman,

yeah!!
Thats ist.
Don't do that.....

Regards

Udo Seiler