Re: ACK RST on rejected services
"Tsaousis, Costa" <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.firehol.user |
|---|---|
| Message-ID | <CANL+Vpb2ZBceZq_kQp5dn7khpB0K9y9zaJ_1Z6z-qo+149yFyw@mail.gmail.com> |
ok. I just pushed the fix to github. Thanks for reporting it. To get the latest firehol do this: git clone https://github.com/ktsaou/firehol.git firehol.git The above will create directory firehol.git. FireHOL is sbin/firehol.in You can run it from there. Costa On Wed, Mar 11, 2015 at 7:01 PM, Tsaousis, Costa <[email protected]> wrote: > Hm... interesting... > > This is what happens: > > 1. Your client sends the TCP SYN packet > 2. The firewall receives this TCP SYN packet and matches the rule to reject it > 3. Since rejection is requested, the firewall should respond with a > TCP-RESET message to prevent timeout. > 4. The firewall tries to send this TCP-RESET (ACK-RST), but... > 5. It is not allowed to do so, by the policy... > 6. Which logs it. > > I'll try to look to it and come back with a solution. > > Costa > > > On Wed, Mar 11, 2015 at 5:10 PM, Rich <[email protected]> wrote: >> >> >> Hello super-helpful and knowledgeable beings! >> >> So I think the pertinent part of my config looks like this: >> >> interface4 eth0 foo src $MY_LAN_SUBNET dst $MY_LAN_IP >> >> policy reject >> >> client all accept >> >> server all reject >> >> The last line is there so we don't log the rejections. However, if I >> then from another machine (10.67.5.4) on the LAN send a packet (e.g. >> with netcat) to this then I still see in the logs: >> >> OUT-foo:IN= OUT=eth0 SRC=$MY_LAN_IP DST=10.67.5.4 LEN=40 TOS=0x00 >> PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=3306 DPT=55237 WINDOW=0 RES=0x00 >> ACK RST URGP=0 >> >> there is no logging on the IN part, because of the "server all reject" >> config. I would have expected that to also not log the reciprocal line >> in the OUT chain? (because it's explicitly rejected) >> >> Is there a way to silence these in the logs? If it's rejected the >> packet, why is there an ACK RST going back anyway? >> >> Thanks, >> >> Rich >> >> >> _______________________________________________ >> Firehol-support mailing list >> [email protected] >> http://lists.firehol.org/mailman/listinfo/firehol-support