Firewall UDP ? Attack !! Or Normal ?

[A Former User]

@johnpoz said in Firewall UDP ? Attack !! Or Normal ?:

I would contact the domain owners for med.com.do

Done.

[johnpoz]

@silence Or could be when the ISP was changing the PTRs on the IP they F'd it up and put it on yours vs where it was suppose to go..

And this med.com.do never had anything to ever with your IP..

But will be interesting if you hear from them.. Let us know..

[A Former User]

@johnpoz said in Firewall UDP ? Attack !! Or Normal ?:

Or could be when the ISP was changing the PTRs on the IP they F'd it up and put it on yours vs where it was suppose to go..
And this med.com.do never had anything to ever with your IP..
But will be interesting if you hear from them.. Let us know..

Yes, I am trying to get in contact with the owner of med.com.do and with my isp, I will keep this thread informed, because whatever this is it does cause a problem.

[johnpoz]

@silence I do show the current PTR for where that vpn2 fqdn points to be set..

;; QUESTION SECTION:
;42.66.51.179.in-addr.arpa. IN PTR

;; ANSWER SECTION:
42.66.51.179.in-addr.arpa. 38400 IN PTR vpn2.med.com.do.

[bmeeks]

@silence said in Firewall UDP ? Attack !! Or Normal ?:

@johnpoz said in Firewall UDP ? Attack !! Or Normal ?:

Or could be when the ISP was changing the PTRs on the IP they F'd it up and put it on yours vs where it was suppose to go..
And this med.com.do never had anything to ever with your IP..
But will be interesting if you hear from them.. Let us know..

Yes, I am trying to get in contact with the owner of med.com.do and with my isp, I will keep this thread informed, because whatever this is it does cause a problem.

I did a "Who Is" on that domain and it reports them as a banking and finance operation in Santo Domingo, Dominican Republic. Perhaps they changed ISPs or IPs, and still have a misconfigured device trying to establish a site-to-site VPN or something ?? Or perhaps it's a way for their customers to connect with them and someone didn't get the word on a new IP.

[johnpoz]

@bmeeks said in Firewall UDP ? Attack !! Or Normal ?:

them and someone didn't get the word on a new IP.

Yeah you would think this - but clearly that would not be working, so you would think someone would notice something not working ;)

[A Former User]

@johnpoz said in Firewall UDP ? Attack !! Or Normal ?:

so you would think someone would notice something not working ;)

I keep aiming for an attack, because really, how is it possible for someone to keep trying the same port every day and realize they don't get a response but still continue... unless they want to do it on purpose?

[bingo600]

@silence said in Firewall UDP ? Attack !! Or Normal ?:

I keep aiming for an attack, because really, how is it possible for someone to keep trying the same port every day and realize they don't get a response but still continue... unless they want to do it on purpose?

Why would someone "waste" 33Mbit/s bw on attacking you ?

[A Former User]

@bingo600 said in Firewall UDP ? Attack !! Or Normal ?:

Why would someone "waste" 33Mbit/s bw on attacking you ?

I don't know, I'm just trying to understand what's going on...and why I can't use my IP xD

[bmeeks]

@silence said in Firewall UDP ? Attack !! Or Normal ?:

@bingo600 said in Firewall UDP ? Attack !! Or Normal ?:

Why would someone "waste" 33Mbit/s bw on attacking you ?

I don't know, I'm just trying to understand what's going on...and why I can't use my IP xD

Don't focus too much on it being an attack. It really does appear more likely to be a misconfigured box somewhere else pointing to what is now the "wrong IP" for some data path. And because the traffic is UDP, the sender will have no idea the data is not getting where he wants it. He will just keep sending what he was set up to send. And with UDP that is by design -- the sender just "assumes" the data got there. And by "he", I don't mean a human. I'm thinking a dumb device like maybe a dedicated point-to-point hardware device.

So assuming somebody once had a device configured to send a set of data via UDP to the IP you now have, if that device was not reconfigured to the new IP, it would still be streaming the same stuff to the old IP. Now, like @johnpoz said earlier, you would think someone at the other end of the session would notice things were not right and look into it. But who knows ???

[Gertjan]

@bmeeks
Yes, very that

The issue will be over if this 'some one' will finally check the logs of his / this device, understand that some cron (?) task somewhere is using hard coded IP or domain name, and it fails now, or at least doesn't do what it should be doing.
He will update his stuff, and the issue will be gone.

[A Former User]

@bmeeks said in Firewall UDP ? Attack !! Or Normal ?:

I don't mean a human.

Totally agree with you, the only problem is because from so many different IPs?

[A Former User]

@bingo600 @bmeeks @Gertjan @johnpoz @SteveITS

Guys, I bring you a new update, about the case...

During the weekend I am not in the office and I usually have some alerts that help me monitor the service remotely.

Well, this alert appears during Saturday morning.

Today I go back to the office, and when I check my wan (it doesn't work) for some reason it's as if my isp has disconnected me completely. (I already sent the report to my isp and they are evaluating the situation)

but this confirms once again that something is not right in that wan.

[JeGr]

@silence said in Firewall UDP ? Attack !! Or Normal ?:

Today I go back to the office, and when I check my wan (it doesn't work) for some reason it's as if my isp has disconnected me completely. (I already sent the report to my isp and they are evaluating the situation)
but this confirms once again that something is not right in that wan.

Huh? Causality vs. correlation. Because you seem to have strange traffic and now your ISP supposedly has cut you off that confirms anything? That's no troubleshooting or debugging, that is pure guessing and crystal ball reading

I'd check my ISP first to confirm that sth. was amiss on my line and that's why they disconnected me. Could also be just a faulty uplink, problem with the ISP itself etc. etc. All other things are just guesses and no evidence there's something not right on your WAN.

Cheers

[A Former User]

@bingo600 @bmeeks @Gertjan @JeGr @johnpoz @SteveITS Updates:

Another ip range and another port equal to udp directed to my wan.

I don't want to hear the obvious, I ignore this kind of traffic alright, but what I'm looking for is to come to a conclusion, what are they trying to do?

If anyone has anything, I'm open to hearing.

[johnpoz]

@silence well 2096 is NBX-DIR, what that is used for - not sure.. cpanel something most likely from the info given here

https://www.speedguide.net/port.php?port=2096

[noplan]

@silence

Haha u r being hacked cuz of a misconfiguration of your firewall

Ok fair...
So now where are is the rulset and what services r u providing behind your firewall

BR
NoPlan

[deanfourie]

@noplan but........

The traffic's being..............blocked?

[johnpoz]

@silence what is the dest port? That is source port 2096? For all we know your generating the traffic and not allowing the answer?

I first read it as that was your IP and port.. But your hiding what port they are going to?

[noplan]

This post is deleted!