Firewall UDP ? Attack !! Or Normal ?
-
@silence I do show the current PTR for where that vpn2 fqdn points to be set..
;; QUESTION SECTION:
;42.66.51.179.in-addr.arpa. IN PTR;; ANSWER SECTION:
42.66.51.179.in-addr.arpa. 38400 IN PTR vpn2.med.com.do. -
@silence said in Firewall UDP ? Attack !! Or Normal ?:
@johnpoz said in Firewall UDP ? Attack !! Or Normal ?:
Or could be when the ISP was changing the PTRs on the IP they F'd it up and put it on yours vs where it was suppose to go..
And this med.com.do never had anything to ever with your IP..
But will be interesting if you hear from them.. Let us know..Yes, I am trying to get in contact with the owner of med.com.do and with my isp, I will keep this thread informed, because whatever this is it does cause a problem.
I did a "Who Is" on that domain and it reports them as a banking and finance operation in Santo Domingo, Dominican Republic. Perhaps they changed ISPs or IPs, and still have a misconfigured device trying to establish a site-to-site VPN or something ?? Or perhaps it's a way for their customers to connect with them and someone didn't get the word on a new IP.
-
@bmeeks said in Firewall UDP ? Attack !! Or Normal ?:
them and someone didn't get the word on a new IP.
Yeah you would think this - but clearly that would not be working, so you would think someone would notice something not working ;)
-
@johnpoz said in Firewall UDP ? Attack !! Or Normal ?:
so you would think someone would notice something not working ;)
I keep aiming for an attack, because really, how is it possible for someone to keep trying the same port every day and realize they don't get a response but still continue... unless they want to do it on purpose?
-
@silence said in Firewall UDP ? Attack !! Or Normal ?:
I keep aiming for an attack, because really, how is it possible for someone to keep trying the same port every day and realize they don't get a response but still continue... unless they want to do it on purpose?
Why would someone "waste" 33Mbit/s bw on attacking you ?
-
@bingo600 said in Firewall UDP ? Attack !! Or Normal ?:
Why would someone "waste" 33Mbit/s bw on attacking you ?
I don't know, I'm just trying to understand what's going on...and why I can't use my IP xD
-
@silence said in Firewall UDP ? Attack !! Or Normal ?:
@bingo600 said in Firewall UDP ? Attack !! Or Normal ?:
Why would someone "waste" 33Mbit/s bw on attacking you ?
I don't know, I'm just trying to understand what's going on...and why I can't use my IP xD
Don't focus too much on it being an attack. It really does appear more likely to be a misconfigured box somewhere else pointing to what is now the "wrong IP" for some data path. And because the traffic is UDP, the sender will have no idea the data is not getting where he wants it. He will just keep sending what he was set up to send. And with UDP that is by design -- the sender just "assumes" the data got there. And by "he", I don't mean a human. I'm thinking a dumb device like maybe a dedicated point-to-point hardware device.
So assuming somebody once had a device configured to send a set of data via UDP to the IP you now have, if that device was not reconfigured to the new IP, it would still be streaming the same stuff to the old IP. Now, like @johnpoz said earlier, you would think someone at the other end of the session would notice things were not right and look into it. But who knows ???
-
@bmeeks
Yes, very that
The issue will be over if this 'some one' will finally check the logs of his / this device, understand that some cron (?) task somewhere is using hard coded IP or domain name, and it fails now, or at least doesn't do what it should be doing.
He will update his stuff, and the issue will be gone. -
@bmeeks said in Firewall UDP ? Attack !! Or Normal ?:
I don't mean a human.
Totally agree with you, the only problem is because from so many different IPs?
-
@bingo600 @bmeeks @Gertjan @johnpoz @SteveITS
Guys, I bring you a new update, about the case...
During the weekend I am not in the office and I usually have some alerts that help me monitor the service remotely.
Well, this alert appears during Saturday morning.
Today I go back to the office, and when I check my wan (it doesn't work) for some reason it's as if my isp has disconnected me completely. (I already sent the report to my isp and they are evaluating the situation)
but this confirms once again that something is not right in that wan.
-
@silence said in Firewall UDP ? Attack !! Or Normal ?:
Today I go back to the office, and when I check my wan (it doesn't work) for some reason it's as if my isp has disconnected me completely. (I already sent the report to my isp and they are evaluating the situation)
but this confirms once again that something is not right in that wan.Huh? Causality vs. correlation. Because you seem to have strange traffic and now your ISP supposedly has cut you off that confirms anything? That's no troubleshooting or debugging, that is pure guessing and crystal ball reading
I'd check my ISP first to confirm that sth. was amiss on my line and that's why they disconnected me. Could also be just a faulty uplink, problem with the ISP itself etc. etc. All other things are just guesses and no evidence there's something not right on your WAN.
Cheers
-
@bingo600 @bmeeks @Gertjan @JeGr @johnpoz @SteveITS Updates:
Another ip range and another port equal to udp directed to my wan.
I don't want to hear the obvious, I ignore this kind of traffic alright, but what I'm looking for is to come to a conclusion, what are they trying to do?
If anyone has anything, I'm open to hearing.
-
@silence well 2096 is NBX-DIR, what that is used for - not sure.. cpanel something most likely from the info given here
https://www.speedguide.net/port.php?port=2096
-
@silence
Haha u r being hacked cuz of a misconfiguration of your firewall
Ok fair...
So now where are is the rulset and what services r u providing behind your firewallBR
NoPlan -
@noplan but........
The traffic's being..............blocked?
-
@silence what is the dest port? That is source port 2096? For all we know your generating the traffic and not allowing the answer?
I first read it as that was your IP and port.. But your hiding what port they are going to?
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 24.11 | Lab VMs 2.8, 24.11 -
This post is deleted! -
without knowning what services he is providing behind his firewall to his clients I think we are not able to help him out, especially minding the early posts and informations (VPN inherit IP and traffic and on and on )
the next step for him will be to set up surricata and monitor this inbound WAN traffic on UDP against every avail list for the IDS/IPS system
@deanfourie yes I know that he blocked that UDP Traffic,
but he @Silence never told us what services he is providing behind his firewall so maybe this is traffic is what his clients are requesting but he is blocking (think about 200 clients as he told, so a lot of nasty stuff can happen)until there he provides us with more info lets sing all together ...
I don't practice Santeria, I ain't got no crystal ball .... -
@noplan @bingo600 @bmeeks @deanfourie @Gertjan @JeGr @johnpoz @noplan @SteveITS
Hey guys I'm back today again (tried to use this service and I keep getting weird traffic this time the port is 1987/UDP
and the range of ips are different from the view above...
As I see this port could be a Trojan.
-
@noplan said in Firewall UDP ? Attack !! Or Normal ?:
never told us what services he is providing behind his firewall
It's just my router (I don't have any services behind it)
@johnpoz said in Firewall UDP ? Attack !! Or Normal ?:
I first read it as that was your IP and port.. But your hiding what port they are going to?
destination port were random at that time.
