From mboxrd@z Thu Jan 1 00:00:00 1970 From: Pascal Hambourg Subject: Re: strange log on gateway inside [] Date: Thu, 29 Jul 2010 11:20:45 +0200 Message-ID: <4C5147ED.2080008@plouf.fr.eu.org> References: <4C513E0B.6040005@unipex.it> Mime-Version: 1.0 Content-Transfer-Encoding: QUOTED-PRINTABLE Return-path: In-Reply-To: <4C513E0B.6040005@unipex.it> Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="iso-8859-1" To: Michele Petrazzo - Unipex Cc: netfilter@vger.kernel.org Hello, Michele Petrazzo - Unipex a =E9crit : > Hi list, > I have a firewall that log some strange, for me, packets on the OUTPU= T > chain that I haven't see before. This is a typical log: >=20 > Firewall DROPOUT- IN=3D OUT=3Deth0 SRC=3DMYPUBBIP DST=3D188.153.11.87 > LEN=3D92 TOS=3D0x00 PREC=3D0xC0 TTL=3D64 ID=3D49303 PROTO=3DICMP = TYPE=3D3 CODE=3D3 > [SRC=3D188.153.11.87 DST=3DMYADDITIONALIP LEN=3D64 TOS=3D0x00 PREC=3D= 0x00 TTL=3D118 > ID=3D28851 DF PROTO=3DTCP SPT=3D12387 DPT=3D51684 WINDOW=3D17424 RES=3D= 0x00 ACK SYN > URGP=3D0 ] >=20 > My output chain: > *filter > :OUTPUT DROP [4831251:620928037] > -A OUTPUT -o lo -j ACCEPT > -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT > -A OUTPUT -j LOG --log-prefix "Firewall DROPOUT- " >=20 > On it I have more that one pubb ip addrs and, the MYPUBBIP is the fir= st > and primary, the MYADDITIONALIP if one of the secondaries. >=20 > The question. Why I see this log and why my fw want to talk with > external and, the last, why the kernel double log talk and one is ins= ide > the brackets [ ] ? This is an ICMP error packet. Type 3 code 3 means "destination port unreachable". An ICMP error packet contains the beginning (including th= e header) of the original packet which triggered the error, printed withi= n brackets in the log. Here the original packet was TCP from 188.153.11.8= 7 to MYADDITIONALIP. ICMP port unreachable is not the natural reply to an unexpected TCP packet, so I guess it was generated by a REJECT target i= n the INPUT or FORWARD chain. If the original packet was in the INVALID state (or UNTRACKED if you used the NOTRACK target), then the ICMP erro= r packet is in the INVALID state instead of RELATED.