Re: What are these and how can I not log them?

[Grant Taylor <gtaylor@riverviewtech.net>]

On 7/7/2008 5:57 PM, Simon wrote:
> Thanks for the response...

You are welcome.

> Ok, makes sense, at least for the computers inside my network - but when 
> the flood happens, it is from a non-local IP address, although I can't 
> swear that the source/dest ports are the same... I'll have to watch for 
> the next one and grab a snippet...

Hum.  I'd be between curious to concerned to find unexpected IPs in 
logs.  Now, if the logs are the "Default Drop and Log" type and not just 
your internal interface, then it could be external traffic that appears 
similar.

> Yeah, I had someone help me set this up years ago, and I told him I 
> wanted it buttoned up as tight as possible. He even added rules to block 
> most OUT bound traffic as well, which I have since learned is probably 
> not a great idea...

Doing egress filtering is not necessarily a bad idea, you just have to 
be careful.  Usually egress filtering helps ensure that you are a good 
internet neighbor which is usually a good thing.

> Any chance you or someone could help me in re-evaluating my current 
> ruleset?

I'm not sure that this mailing list is the best place to ask for help in 
creating and / or (re)assessing a rule set.  IMHO this list is more of a 
place to ask how to make something specific work rather than how should 
I / what firewall should I use for my network with this <bla> config. 
(However I'd be willing to do so off list if you will email me directly.)

> To dump the current rules to a file I'd just do:
> 
> iptables-save > myrules
> 
> Then just copy/paste the contents here for evaluation (if thats ok)?

Yes, that will probably work the best.

> Thanks again for your time...

*nod*

You are welcome.



Grant. . . .