Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfSense 2.0 Suspicious IP Connections

    Off-Topic & Non-Support Discussion
    2
    3
    1.1k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      pfSense333
      last edited by

      I know my pfSense version is outdated, but its running on a old WRAP PC Engines board.

      Anyway I was monitoring the connections on the network and noticed this box that runs pfSense and no plugins or add-on's is connecting to 2 IP's which had me concerned.

      The suspicious IP's are:
      67.227.252.196 - NSLOOKUP shows amsat.org
      72.14.183.239 - NSLOOKUP shows jtsage.com

      Any idea why that is? I've already blacklisted these IP's, but would like to fix the fault/flaw.

      Thanks

      1 Reply Last reply Reply Quote 0
      • C
        cmb
        last edited by

        Connecting to them with what protocol/port? With that description, guessing UDP 123, NTP time sync traffic to pool.ntp.org members.

        1 Reply Last reply Reply Quote 0
        • P
          pfSense333
          last edited by

          @cmb:

          Connecting to them with what protocol/port? With that description, guessing UDP 123, NTP time sync traffic to pool.ntp.org members.

          Thanks, I haven’t checked which protocol/port. I will try that, but first I changed the NTP server to see if the problem stops.

          1 Reply Last reply Reply Quote 0
          • First post
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.