Date: Tue, 1 Jan 2002 16:11:46 -0800 (PST) From: Brian Whalen <bri@sonicboom.org> To: Joe & Fhe Barbish <barbish@a1poweruser.com> Cc: FBSD Questions <questions@FreeBSD.ORG> Subject: RE: IPFW UDP port# 520 Message-ID: <20020101160500.W4083-100000@5131-073-209.015.popsite.net> In-Reply-To: <LPBBIGIAAKKEOEJOLEGOIEPJCKAA.barbish@a1poweruser.com>
next in thread | previous in thread | raw e-mail | index | archive | help
look at your rc.conf to see which ruleset is being loaded, by default its
one of the sets out of /etc/rc.firewall.
You quoted 208.203.25.3:520 63.163.61.14:520 as the example, perhaps
${fwcmd} add pass udp from 208.203.25.3 520 to 63.163.61.14 520
is what you need?
Brian "Sonic" Whalen
Success = Preparation + Opportunity
On Tue, 1 Jan 2002, Joe & Fhe Barbish wrote:
> I know where my rules live.
> What I need to find out is
> What ipfw rules do I need to add to my rules list to provide the
> correct response to make that router happy and shut up?
>
>
> -----Original Message-----
> From: Brian Whalen [mailto:bri@sonicboom.org]
> Sent: Tuesday, January 01, 2002 6:29 PM
> To: Joe & Fhe Barbish
> Cc: FBSD Questions
> Subject: RE: IPFW UDP port# 520
>
> Look at your /etc/rc.conf to see what firewall file is being loaded and
> edit that file. Are you using the simple, client, or another setup?
>
> Brian "Sonic" Whalen
> Success = Preparation + Opportunity
>
>
> On Tue, 1 Jan 2002, Joe & Fhe Barbish wrote:
>
> > I did not put the real IP address in the post, just changed
> > the numbers to protect myself.
> > The ISP real IP address does do a reverse dns ok.
> >
> > This machine is a virgin install of FBSD never been connected to
> > the internet without firewall. There's no way that the Ripper
> > Trojan could have infested my box. The 520's I am receiving can
> > Only be from my ISP's router.
> >
> > What ipfw rules do I need to respond to make that router
> > happy and shut up?
> >
> >
> > -----Original Message-----
> > From: Brian Whalen [mailto:bri@sonicboom.org]
> > Sent: Tuesday, January 01, 2002 4:36 PM
> > To: Joe & Fhe Barbish
> > Cc: FBSD Questions
> > Subject: Re: IPFW UDP port# 520
> >
> > Well I'd be a little suspicious due to the lack of a reverse dns entry for
> > that ip. According to arin, that ip belongs to Alexia Internet. This
> > your isp? Is that ip your gsteway for traffic back out?
> >
> > Brian "Sonic" Whalen
> > Success = Preparation + Opportunity
> >
> >
> > On Tue, 1 Jan 2002, Joe & Fhe Barbish wrote:
> >
> > > Happy new year to all FBSD list readers.
> > >
> > > I see in my security log a lot of denied packets over and
> > > over again of the same kind.
> > >
> > > Deny UDP 208.203.25.3:520 63.163.61.14:520 in via tun0
> > >
> > > 208.203.25.3 is my ISP's IP address and 63.163.61.14 is my IP address.
> > >
> > > When I lookup what port 520 is it says a local routing process
> > > or Trojan Ripper. I think it's my ISP's front door router
> > > inquiring if I am still there.
> > > Since my firewall is denying the request it just keeps repeating.
> > >
> > > How can I be sure It's my ISP's router and not the Ripper Trojan?
> > >
> > > What rules do I need the add to my IPFW rules set to resolve this?
> > >
> > > Thanks
> > >
> > > Joe
> > >
> > >
> > > To Unsubscribe: send mail to majordomo@FreeBSD.org
> > > with "unsubscribe freebsd-questions" in the body of the message
> > >
> >
>
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020101160500.W4083-100000>