Re: bug? blocked packets get shadowed to internal network

["Dharmendra.T" <dharmu@nsecure.net>]

[-- Attachment #1: Type: text/plain, Size: 1697 bytes --]

hi,

When I saw your logs it is sending a rst packet to destination. Are you
running any ids inside your network? 


Regards
Dharmendra.T
dharmu@nsecure.net


On Thu, 2003-08-14 at 15:04, Juergen Stohr wrote:

    Hi to all,
    
    we are using a firewall with RedHat kernel 2.4.20-19.7. The firewall is 
    configured to block every packet with DPT 199 into our network. When doing
    a "telnet server.in.our.network 199" from outside, the firewall correctly 
    drops that packet, logging
    
    IN=eth1 OUT=eth0 SRC=xxx.xxx.11.231 DST=xxx.xxx.151.184 LEN=44 TOS=0x00 PREC=0x00 TTL=252 ID=12615 DF PROTO=TCP SPT=34869 DPT=199 WINDOW=8760 RES=0x00 SYN URGP=0
    
    to syslog. The external interface is eth1, internal is eth0.
    However, at the same time, the firewall generates a packet, which is droped
    by the output chain of the firewall. It fakes the SRC and DST and wants to send
    that packet to the internal server:
    
    IN= OUT=eth0 SRC=xxx.xxx.151.184 DST=xxx.xxx.11.231 LEN=40 TOS=0x00 PREC=0x00 TTL=255 ID=0 DF PROTO=TCP SPT=199 DPT=34869 WINDOW=0 RES=0x00 ACK RST URGP=0
    
    When setting the output chain to accept policy, the above packet is delivered
    xxx.xxx.151.184!
    
    How can we prohibit those packets to be generated? Kernel RH 2.4.18-x didn't
    show that behaviour.
    
    Please CC me as I'm not subscribed.
    
    regards,
    	juergen
    
    

-- 

This message is intended for the addressee only. It may contain
privileged or Confidential information. If you have received this
message in error,please notify the sender and destroy the message
immediately.Unauthorised use or reproduction of this message is strictly
prohibited.

[-- Attachment #2: Type: text/html, Size: 3616 bytes --]