Why is the FW responding?
-
Check the states for port 32400 while that's happening.
That could just be something behind pfSense opening a connection to that port externally.
Steve
-
I should have known to look there.
There is an amazing number of connections outgoing that are explainable.Thanks for the quick response and the point in the right direction.
-
@AndyRH 32400 is the plex port btw.
But sure it could be random luck that is a port being used as source while something(s) talk to outside ports.
But those other ports look pretty random, so those seem like source ports.
You have stuff talking to plex servers your buddies are running or something.. 2 of those IPs are
lightspeed.rcsntx.sbcglobal.net.
-
@johnpoz The state table had a number of internal computers talking to other Plex servers. My last server change left Plex on another port.
-
@AndyRH said in Why is the FW responding?:
The state table had a number of internal computers talking to other Plex servers.
yup that sounds right from what it looks like.. So you don't want your devices talking to plex?
-
@johnpoz said in Why is the FW responding?:
So you don't want your devices talking to plex?
No, a friend noticed that he was getting lots of hack attempts against his Plex server and wondered how many I was getting. Because mine is on a different port I figured a pcap on the wan for 32400 would tell me more. And it did. Really just looking and comparing.
-
@AndyRH hack attempts??
Sure wasn't just his users or plex checking its available remote?
What are some of the IPs he thinks are attacking him? Could be known scanners, strechoid likes to scan for 32400.. I just block all those known scanner Ips. And like you I don't run plex on 32400 external, I use a different port. And I only allow US ips as well. And belgium currently since I have family living there at the moment.
Here is the only hit I currently see in my firewall to 32400
Now I if I just look IPs I block in my scan deny list, see quite a lot of hits, but they are to all sorts of ports
-
643 matched hits in your firewall, your an popular man, I only had 67 hits from scanners
I don't know what you have been doing to piss them off, hehe -
@MoonKnight you sure you have identified all the different scanners as scanners?
-
@johnpoz
I believe so, maybe you have lot more. Like to share?
I do have all of them from the "Feeds" in pfBlocker -
@MoonKnight this is all the IPs currently in my scandeny table
-
Wow I only had 8K ips in my lists. Can I borrow your list? :)
You don't have the IPv4 source definitions ? -
@MoonKnight this is what I pull from.
But then I have a whole bunch of IPs in custom, not exactly sure where I pulled them all from.. So figured it might be easier to just dump the table that gets created.
-
@johnpoz
Thanks, this is the list i'm using. Am going to add yours too :)
