From: "terry l. ridder" <artisticforge@gmail.com>
To: netfilter@lists.netfilter.org
Subject: iptables leaking blocked ip addresses.
Date: Mon, 20 Jun 2005 10:34:46 -0500 [thread overview]
Message-ID: <49bf7d7050620083448c1dee9@mail.gmail.com> (raw)
hello;
i have recently noticed that iptables is leaking blocked ip addresses into
the local network.
one example of the leak is below:
200.0.0.0/8 is dropped if the destination port is 25 (smtp).
the large majority of the packets are dropped but a random few are leaking
pass iptables.
404 19712 DROP tcp -- eth2 * 200.0.0.0/8
0.0.0.0/0 tcp dpt:25
143 6992 DROP tcp -- eth2 * 201.0.0.0/8
0.0.0.0/0 tcp dpt:25
at the 2nd lines of defenses the following is seen:
date and time is utc.
2005-06-18 08:20:38.310864 IP 200.221.11.147.29937 >
204.238.34.206.25: R 0:0(0) win 0
2005-06-18 08:35:33.035504 IP 200.221.11.147.9618 > 204.238.34.206.25:
R 3184482893:3184482893(0) win 64240
2005-06-18 09:12:47.772699 IP 200.221.11.147.37399 >
204.238.34.206.25: R 0:0(0) win 0
2005-06-18 10:15:29.731794 IP 200.221.11.147.37803 >
204.238.34.206.25: R 3790354139:3790354139(0) win 64240
2005-06-18 12:28:47.356603 IP 200.221.11.147.37540 >
204.238.34.206.25: R 3124247582:3124247582(0) win 64240
2005-06-18 14:42:14.852914 IP 200.221.11.147.59505 >
204.238.34.206.25: R 2944314039:2944314039(0) win 64240
2005-06-18 16:56:23.417184 IP 200.221.11.147.51204 >
204.238.34.206.25: R 3050896753:3050896753(0) win 64240
2005-06-18 19:09:00.235525 IP 200.221.11.147.14427 >
204.238.34.206.25: R 2304489220:2304489220(0) win 64240
2005-06-18 21:22:08.824748 IP 200.221.11.147.54471 >
204.238.34.206.25: R 2920726621:2920726621(0) win 64240
2005-06-18 23:35:36.046110 IP 200.221.11.147.27797 >
204.238.34.206.25: R 0:0(0) win 0
2005-06-19 01:49:10.050142 IP 200.221.11.147.29328 >
204.238.34.206.25: R 0:0(0) win 0
2005-06-19 04:01:59.082248 IP 200.221.11.147.23754 >
204.238.34.206.25: R 0:0(0) win 0
2005-06-19 06:15:32.815212 IP 200.221.11.147.46328 >
204.238.34.206.25: R 1445346336:1445346336(0) win 64240
computers are all running debian sarge with kernel 2.6.11.10 and iptables
version iptables v1.2.11.
i also have a short web page concerning the iptables leaks at:
http://204.238.34.206/iptables-leaks.txt
--
terry l. ridder ><>
next reply other threads:[~2005-06-20 15:34 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-06-20 15:34 terry l. ridder [this message]
2005-06-20 15:48 ` iptables leaking blocked ip addresses Jan Engelhardt
2005-06-20 16:01 ` terry l. ridder
2005-06-20 15:55 ` /dev/rob0
2005-06-20 16:00 ` /dev/rob0
2005-06-20 16:17 ` terry l. ridder
2005-06-20 16:59 ` /dev/rob0
2005-06-20 17:20 ` terry l. ridder
2005-06-20 18:29 ` /dev/rob0
2005-06-20 19:36 ` terry l. ridder
2005-06-20 20:19 ` /dev/rob0
2005-06-21 12:57 ` Jan Engelhardt
2005-06-21 13:10 ` Jozsef Kadlecsik
2005-06-21 13:13 ` Jan Engelhardt
2005-06-21 13:39 ` Jozsef Kadlecsik
2005-06-21 18:05 ` Jan Engelhardt
2005-06-22 7:10 ` Jozsef Kadlecsik
2005-06-22 12:55 ` Jan Engelhardt
2005-06-22 13:16 ` Jozsef Kadlecsik
2005-06-20 20:47 ` terry l. ridder
2005-06-21 12:17 ` /dev/rob0
2005-06-21 14:36 ` terry l. ridder
2005-06-21 14:57 ` Joakim Axelsson
2005-06-20 18:50 ` Jan Engelhardt
2005-06-20 19:12 ` /dev/rob0
2005-06-20 19:30 ` Sven-Haegar Koch
2005-06-20 20:07 ` /dev/rob0
2005-06-20 20:23 ` terry l. ridder
2005-06-20 22:29 ` Sven-Haegar Koch
2005-06-20 23:04 ` terry l. ridder
2005-06-20 20:39 ` terry l. ridder
2005-06-21 7:11 ` Jozsef Kadlecsik
2005-06-21 7:21 ` terry l. ridder
2005-06-21 7:56 ` Jozsef Kadlecsik
2005-06-21 8:24 ` terry l. ridder
2005-06-21 9:36 ` Feizhou
2005-06-21 9:40 ` Jozsef Kadlecsik
2005-06-21 14:31 ` Cedric Blancher
2005-06-21 16:52 ` Feizhou
2005-06-21 3:24 ` Alistair Tonner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=49bf7d7050620083448c1dee9@mail.gmail.com \
--to=artisticforge@gmail.com \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox