From: "terry l. ridder" <artisticforge@gmail.com>
To: netfilter@lists.netfilter.org
Subject: iptables leaking blocked ip addresses.
Date: Mon, 20 Jun 2005 10:34:46 -0500 [thread overview]
Message-ID: <49bf7d7050620083448c1dee9@mail.gmail.com> (raw)
hello;
i have recently noticed that iptables is leaking blocked ip addresses into
the local network.
one example of the leak is below:
200.0.0.0/8 is dropped if the destination port is 25 (smtp).
the large majority of the packets are dropped but a random few are leaking
pass iptables.
404 19712 DROP tcp -- eth2 * 200.0.0.0/8
0.0.0.0/0 tcp dpt:25
143 6992 DROP tcp -- eth2 * 201.0.0.0/8
0.0.0.0/0 tcp dpt:25
at the 2nd lines of defenses the following is seen:
date and time is utc.
2005-06-18 08:20:38.310864 IP 200.221.11.147.29937 >
204.238.34.206.25: R 0:0(0) win 0
2005-06-18 08:35:33.035504 IP 200.221.11.147.9618 > 204.238.34.206.25:
R 3184482893:3184482893(0) win 64240
2005-06-18 09:12:47.772699 IP 200.221.11.147.37399 >
204.238.34.206.25: R 0:0(0) win 0
2005-06-18 10:15:29.731794 IP 200.221.11.147.37803 >
204.238.34.206.25: R 3790354139:3790354139(0) win 64240
2005-06-18 12:28:47.356603 IP 200.221.11.147.37540 >
204.238.34.206.25: R 3124247582:3124247582(0) win 64240
2005-06-18 14:42:14.852914 IP 200.221.11.147.59505 >
204.238.34.206.25: R 2944314039:2944314039(0) win 64240
2005-06-18 16:56:23.417184 IP 200.221.11.147.51204 >
204.238.34.206.25: R 3050896753:3050896753(0) win 64240
2005-06-18 19:09:00.235525 IP 200.221.11.147.14427 >
204.238.34.206.25: R 2304489220:2304489220(0) win 64240
2005-06-18 21:22:08.824748 IP 200.221.11.147.54471 >
204.238.34.206.25: R 2920726621:2920726621(0) win 64240
2005-06-18 23:35:36.046110 IP 200.221.11.147.27797 >
204.238.34.206.25: R 0:0(0) win 0
2005-06-19 01:49:10.050142 IP 200.221.11.147.29328 >
204.238.34.206.25: R 0:0(0) win 0
2005-06-19 04:01:59.082248 IP 200.221.11.147.23754 >
204.238.34.206.25: R 0:0(0) win 0
2005-06-19 06:15:32.815212 IP 200.221.11.147.46328 >
204.238.34.206.25: R 1445346336:1445346336(0) win 64240
computers are all running debian sarge with kernel 2.6.11.10 and iptables
version iptables v1.2.11.
i also have a short web page concerning the iptables leaks at:
http://204.238.34.206/iptables-leaks.txt
--
terry l. ridder ><>
next reply other threads:[~2005-06-20 15:34 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-06-20 15:34 terry l. ridder [this message]
2005-06-20 15:48 ` iptables leaking blocked ip addresses Jan Engelhardt
2005-06-20 16:01 ` terry l. ridder
2005-06-20 15:55 ` /dev/rob0
2005-06-20 16:00 ` /dev/rob0
2005-06-20 16:17 ` terry l. ridder
2005-06-20 16:59 ` /dev/rob0
2005-06-20 17:20 ` terry l. ridder
2005-06-20 18:29 ` /dev/rob0
2005-06-20 19:36 ` terry l. ridder
2005-06-20 20:19 ` /dev/rob0
2005-06-21 12:57 ` Jan Engelhardt
2005-06-21 13:10 ` Jozsef Kadlecsik
2005-06-21 13:13 ` Jan Engelhardt
2005-06-21 13:39 ` Jozsef Kadlecsik
2005-06-21 18:05 ` Jan Engelhardt
2005-06-22 7:10 ` Jozsef Kadlecsik
2005-06-22 12:55 ` Jan Engelhardt
2005-06-22 13:16 ` Jozsef Kadlecsik
2005-06-20 20:47 ` terry l. ridder
2005-06-21 12:17 ` /dev/rob0
2005-06-21 14:36 ` terry l. ridder
2005-06-21 14:57 ` Joakim Axelsson
2005-06-20 18:50 ` Jan Engelhardt
2005-06-20 19:12 ` /dev/rob0
2005-06-20 19:30 ` Sven-Haegar Koch
2005-06-20 20:07 ` /dev/rob0
2005-06-20 20:23 ` terry l. ridder
2005-06-20 22:29 ` Sven-Haegar Koch
2005-06-20 23:04 ` terry l. ridder
2005-06-20 20:39 ` terry l. ridder
2005-06-21 7:11 ` Jozsef Kadlecsik
2005-06-21 7:21 ` terry l. ridder
2005-06-21 7:56 ` Jozsef Kadlecsik
2005-06-21 8:24 ` terry l. ridder
2005-06-21 9:36 ` Feizhou
2005-06-21 9:40 ` Jozsef Kadlecsik
2005-06-21 14:31 ` Cedric Blancher
2005-06-21 16:52 ` Feizhou
2005-06-21 3:24 ` Alistair Tonner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=49bf7d7050620083448c1dee9@mail.gmail.com \
--to=artisticforge@gmail.com \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.