FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Debian > Debian User

 
 
LinkBack Thread Tools
 
Old 07-30-2010, 04:31 AM
Mart Frauenlob
 
Default How to get rid of this firewall error.

On 30.07.2010 02:49, Ramasubramanian Ramesh wrote:

It would have helped if I actually include the message :-) Here it is:

[2709614.616138] IN=eth1 OUT=
MAC=00:16:e6:84:37:c5:00:0f:db:5c:a0:58:08:00 SRC=192.168.1.1
DST=192.168.1.47 LEN=36 TOS=0x00 PREC=0x00 TTL=64 ID=37027 PROTO=ICMP
TYPE=8 CODE=0 ID=60352 SEQ=0

192.168.1.47 is my firewall connected to the DSL modem/router (which I
think must be 192.168.1.1)

Ramesh


Ramasubramanian Ramesh wrote:

Hi:

My syslog and console window is repeatedly printing the follwing
message from my firewall setup. I cannot figure out which program or
service is printing this message. My first preference is to modify the
source behavior. The second choice is to stop printing the message.
I guess I could edit the firewall script. But, I like to get some
expert feedback before I proceed this way.

Thanks
Ramesh




top posting - iihh ugly ;-p

well, it's the netfilter code from the kernel instructed by an iptables
rule, that spits out that message.

most likely this is a message informing you about a blocked packet.
the question is: who/what set this iptables rule to tell the kernel to
discard such packets?


my cristal ball is currently somehow foggy, so I can't tell.
maybe you know what firewall frontend you are using?

what to do?
well - to prohibit logging of those packets in the short term a rule
like this may do the job:

iptables -I INPUT -i eth1 -s 192.168.1.1 -p icmp --icmp-type 8 -j DROP

for the long term:
learn how to configure your firewall frontend or iptables.

but it's you modem/router right?
so it might just check if you online. so it could be a 'good packet',
which you might want to accept. - same thing as above just with the
ACCEPT target.



best regards

Mart


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Archive: 4C5255BE.3020205@chello.at">http://lists.debian.org/4C5255BE.3020205@chello.at
 
Old 07-30-2010, 05:01 AM
Ramasubramanian Ramesh
 
Default How to get rid of this firewall error.

top posting - iihh ugly ;-p


well, it's the netfilter code from the kernel instructed by an
iptables rule, that spits out that message.

most likely this is a message informing you about a blocked packet.

the question is: who/what set this iptables rule to tell the kernel to
discard such packets?

my cristal ball is currently somehow foggy, so I can't tell.
maybe you know what firewall frontend you are using?

what to do?

well - to prohibit logging of those packets in the short term a rule
like this may do the job:

iptables -I INPUT -i eth1 -s 192.168.1.1 -p icmp --icmp-type 8 -j DROP

for the long term:
learn how to configure your firewall frontend or iptables.

but it's you modem/router right?

so it might just check if you online. so it could be a 'good packet',
which you might want to accept. - same thing as above just with the
ACCEPT target.

best regards

Mart


My mail tool some times refuses to bottom post, especially, when I reply
to myself. I have to jump through hoops and some time it is easier to
submit to its demands :-)


Agreed. I set up the tables to drop and log messages whenever an
unsolicited message comes from outside. But, I did not think
I setup the router to send periodic pings. I guess the verizon router
(yes, it is mine because verizon gave it to me free) does that because
it is windows centric and it likes to by user friendly by inquiring "are
you there? I greet you, etc."


It may be a good packet or it may be a bad packet. I still do not want
to look at unsolicited packets. I am worried that some one from outside
can spoof as my router. I will just drop this specific packet without
logging it.


Specifically, what does icmp_type = 8 mean?

Ramesh





--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Archive: 4C525C93.4010006@ti.com">http://lists.debian.org/4C525C93.4010006@ti.com
 
Old 07-30-2010, 05:35 AM
"R. Ramesh"
 
Default How to get rid of this firewall error.

Ramasubramanian Ramesh wrote:


top posting - iihh ugly ;-p

well, it's the netfilter code from the kernel instructed by an
iptables rule, that spits out that message.

most likely this is a message informing you about a blocked packet.
the question is: who/what set this iptables rule to tell the kernel
to discard such packets?

my cristal ball is currently somehow foggy, so I can't tell.
maybe you know what firewall frontend you are using?

what to do?
well - to prohibit logging of those packets in the short term a
rule like this may do the job:

iptables -I INPUT -i eth1 -s 192.168.1.1 -p icmp --icmp-type 8 -j DROP

for the long term:
learn how to configure your firewall frontend or iptables.

but it's you modem/router right?
so it might just check if you online. so it could be a 'good
packet', which you might want to accept. - same thing as above just
with the ACCEPT target.

best regards

Mart


My mail tool some times refuses to bottom post, especially, when I
reply to myself. I have to jump through hoops and some time it is
easier to submit to its demands :-)


Agreed. I set up the tables to drop and log messages whenever an
unsolicited message comes from outside. But, I did not think
I setup the router to send periodic pings. I guess the verizon router
(yes, it is mine because verizon gave it to me free) does that because
it is windows centric and it likes to by user friendly by inquiring
"are you there? I greet you, etc."


It may be a good packet or it may be a bad packet. I still do not want
to look at unsolicited packets. I am worried that some one from
outside can spoof as my router. I will just drop this specific packet
without logging it.


Specifically, what does icmp_type = 8 mean?

Ramesh





My bad, I googled icmp_type 8. It seems harmless and required to be
implemented. So I am going to accept.
After filtering out this one, I notice another one coming from my own
firewall and need to figure out who is sending it.


[2731831.967429] IN=eth1 OUT= MAC= SRC=192.168.1.47 DST=192.168.1.255
LEN=233 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=138 DPT=138 LEN=213


I think this from my nmbd on the outgoing port. I am going to
investigate interfaces option in smb.conf. Please tell me if I am on the
wrong path.


Ramesh


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Archive: 4C526491.20700@verizon.net">http://lists.debian.org/4C526491.20700@verizon.net
 
Old 07-30-2010, 07:02 AM
"Steven"
 
Default How to get rid of this firewall error.

On Fri, July 30, 2010 07:35, R. Ramesh wrote:
> My bad, I googled icmp_type 8. It seems harmless and required to be
> implemented. So I am going to accept.
> After filtering out this one, I notice another one coming from my own
> firewall and need to figure out who is sending it.
>
> [2731831.967429] IN=eth1 OUT= MAC= SRC=192.168.1.47 DST=192.168.1.255
> LEN=233 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=138 DPT=138
> LEN=213
>
> I think this from my nmbd on the outgoing port. I am going to
> investigate interfaces option in smb.conf. Please tell me if I am on the
> wrong path.
>
Seems more like an incoming packet (the OUT interface is blank), probably
a smb server or windows machine sending its broadcast message (notice the
.255 in the destination IP)

Regards,
Steven

--
Rarely do people communicate; they just take turns talking.


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: 42335.91.183.48.98.1280473329.squirrel@stevenleeuw .kwik.to">http://lists.debian.org/42335.91.183.48.98.1280473329.squirrel@stevenleeuw .kwik.to
 
Old 07-30-2010, 06:34 PM
Ramasubramanian Ramesh
 
Default How to get rid of this firewall error.

Thanks for every ones help. I resolved all issues with errors from my
firewall. Here is a summary


1) My DSL modem/router periodically pings my machine. If I accept then
it queries more about www server, samba server etc. I do not like these
requests as I do not know what the modem does with that info. The
modem/router is given to me by verizon DSL service. So, I shut off any
incoming packet from that interface that is not already established by
an in-to-out connection. I was doing this before too, but I was loggin
in such message. Now I dropped loging it, if it is from my dsl router.


2) I have virtual machines connected with br0 to internal net, and I did
not do the iptables from br0 to internal net properly and that caused
nmbd queries from br0 (ie from vms) to rest of the internal net to be
dropped and loggged. I updated a few rules and the log messages went away.


3) No my syslog onlyc contains useful messages.

Ramesh


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Archive: 4C531B34.6080801@ti.com">http://lists.debian.org/4C531B34.6080801@ti.com
 

Thread Tools




All times are GMT. The time now is 12:24 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org