From owner-freebsd-questions Tue Jan 1 16:47:29 2002 Delivered-To: freebsd-questions@freebsd.org Received: from mail.mango-bay.com (mail.mango-bay.com [208.206.15.12]) by hub.freebsd.org (Postfix) with ESMTP id 1C3B337B419 for ; Tue, 1 Jan 2002 16:47:23 -0800 (PST) Received: from barbish ([63.70.155.19]) by mail.mango-bay.com (Post.Office MTA v3.5.3 release 223 ID# 0-52377U2500L250S0V35) with SMTP id com; Tue, 1 Jan 2002 19:49:43 -0500 From: "Joe & Fhe Barbish" To: "Brian Whalen" Cc: "FBSD Questions" Subject: RE: IPFW UDP port# 520 Date: Tue, 1 Jan 2002 19:47:14 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 In-Reply-To: <20020101160500.W4083-100000@5131-073-209.015.popsite.net> Importance: Normal Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG All ready tried the obvious. Does not work. This packet still drops through to the default end. Any other ideas? -----Original Message----- From: owner-freebsd-questions@FreeBSD.ORG [mailto:owner-freebsd-questions@FreeBSD.ORG]On Behalf Of Brian Whalen Sent: Tuesday, January 01, 2002 7:12 PM To: Joe & Fhe Barbish Cc: FBSD Questions Subject: RE: IPFW UDP port# 520 look at your rc.conf to see which ruleset is being loaded, by default its one of the sets out of /etc/rc.firewall. You quoted 208.203.25.3:520 63.163.61.14:520 as the example, perhaps ${fwcmd} add pass udp from 208.203.25.3 520 to 63.163.61.14 520 is what you need? Brian "Sonic" Whalen Success = Preparation + Opportunity On Tue, 1 Jan 2002, Joe & Fhe Barbish wrote: > I know where my rules live. > What I need to find out is > What ipfw rules do I need to add to my rules list to provide the > correct response to make that router happy and shut up? > > > -----Original Message----- > From: Brian Whalen [mailto:bri@sonicboom.org] > Sent: Tuesday, January 01, 2002 6:29 PM > To: Joe & Fhe Barbish > Cc: FBSD Questions > Subject: RE: IPFW UDP port# 520 > > Look at your /etc/rc.conf to see what firewall file is being loaded and > edit that file. Are you using the simple, client, or another setup? > > Brian "Sonic" Whalen > Success = Preparation + Opportunity > > > On Tue, 1 Jan 2002, Joe & Fhe Barbish wrote: > > > I did not put the real IP address in the post, just changed > > the numbers to protect myself. > > The ISP real IP address does do a reverse dns ok. > > > > This machine is a virgin install of FBSD never been connected to > > the internet without firewall. There's no way that the Ripper > > Trojan could have infested my box. The 520's I am receiving can > > Only be from my ISP's router. > > > > What ipfw rules do I need to respond to make that router > > happy and shut up? > > > > > > -----Original Message----- > > From: Brian Whalen [mailto:bri@sonicboom.org] > > Sent: Tuesday, January 01, 2002 4:36 PM > > To: Joe & Fhe Barbish > > Cc: FBSD Questions > > Subject: Re: IPFW UDP port# 520 > > > > Well I'd be a little suspicious due to the lack of a reverse dns entry for > > that ip. According to arin, that ip belongs to Alexia Internet. This > > your isp? Is that ip your gsteway for traffic back out? > > > > Brian "Sonic" Whalen > > Success = Preparation + Opportunity > > > > > > On Tue, 1 Jan 2002, Joe & Fhe Barbish wrote: > > > > > Happy new year to all FBSD list readers. > > > > > > I see in my security log a lot of denied packets over and > > > over again of the same kind. > > > > > > Deny UDP 208.203.25.3:520 63.163.61.14:520 in via tun0 > > > > > > 208.203.25.3 is my ISP's IP address and 63.163.61.14 is my IP address. > > > > > > When I lookup what port 520 is it says a local routing process > > > or Trojan Ripper. I think it's my ISP's front door router > > > inquiring if I am still there. > > > Since my firewall is denying the request it just keeps repeating. > > > > > > How can I be sure It's my ISP's router and not the Ripper Trojan? > > > > > > What rules do I need the add to my IPFW rules set to resolve this? > > > > > > Thanks > > > > > > Joe > > > > > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > > > with "unsubscribe freebsd-questions" in the body of the message > > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message