From owner-freebsd-questions Thu Feb 21 9:30:30 2002 Delivered-To: freebsd-questions@freebsd.org Received: from mail.mango-bay.com (mail.mango-bay.com [208.206.15.12]) by hub.freebsd.org (Postfix) with ESMTP id 48B8937B404 for ; Thu, 21 Feb 2002 09:30:26 -0800 (PST) Received: from barbish ([63.70.155.45]) by mail.mango-bay.com (Post.Office MTA v3.5.3 release 223 ID# 0-52377U2500L250S0V35) with SMTP id com; Thu, 21 Feb 2002 12:34:46 -0500 From: "Joe & Fhe Barbish" To: "Simon J Mudd" Cc: "FBSDQ" Subject: RE: ipfw and getting the interface logged Date: Thu, 21 Feb 2002 12:30:22 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) In-Reply-To: X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Importance: Normal Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG This messages are being issued by the log_in_vain="YES" option in rc.conf. These are connection attempts by somebody who is trying to break into your system and got stopped before your IPFW firewall even knows about it. This is a good thing. Do not change anything. You can do a whois ip command to see where those ip address range is registered to. -----Original Message----- From: owner-freebsd-questions@FreeBSD.ORG [mailto:owner-freebsd-questions@FreeBSD.ORG]On Behalf Of Simon J Mudd Sent: Thursday, February 21, 2002 11:19 AM To: freebsd-questions@freebsd.org Subject: ipfw and getting the interface logged Hello, I'm running 4.5-STABLE with ipfw and having trouble with my firewall rules. However they are probably my own doing. Via syslog I see messages of the type: Feb 21 16:13:56 unicorn /kernel: Connection attempt to TCP 44.133.228.2:6000 from 44.133.228.5:2187 Feb 21 16:13:57 unicorn /kernel: Connection attempt to TCP 44.133.228.2:6000 from 44.133.228.5:2188 Which I think my rules should allow: ${fwcmd} add pass all from ${inet} to ${inet} via ${iif} where # set these to your inside interface network and netmask and ip iif="ed0" inet="44.133.228.0/26" iip="44.133.228.2" How can I get syslog to log more information such as at least the interface over which the traffic is arriving? Thanks and regards, Simon -- Simon J Mudd, Tel: +34-91-408 4878, Mobile: +34-605-085 219 Madrid, Spain. email: sjmudd@pobox.com, Postfix RPM Packager To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message