firewall configuration question

wgstarks

I just recently switched to AT&T U-Verse fiber and since then I've been seeing large numbers of blocks in my firewall log, all with the same IP.

Just a small sample-

Jun 4 21:18:02	WAN	52.8.254.146:32099	108.77.84.186:64725	UDP
Jun 4 21:18:02	WAN	34.196.55.206:32099	108.77.84.186:26214	UDP
Jun 4 21:17:18	WAN	35.157.23.15:32099	108.77.84.186:37306	UDP
Jun 4 21:17:18	WAN	52.8.254.146:32099	108.77.84.186:64725	UDP
Jun 4 21:17:18	WAN	34.196.55.206:32099	108.77.84.186:26214	UDP
Jun 4 21:16:34	WAN	35.157.23.15:32099	108.77.84.186:37306	UDP
Jun 4 21:16:34	WAN	52.8.254.146:32099	108.77.84.186:64725	UDP
Jun 4 21:16:34	WAN	34.196.55.206:32099	108.77.84.186:26214	UDP
Jun 4 21:15:50	WAN	35.157.23.15:32099	108.77.84.186:37306	UDP
Jun 4 21:15:50	WAN	52.8.254.146:32099	108.77.84.186:64725	UDP
Jun 4 21:15:49	WAN	34.196.55.206:32099	108.77.84.186:26214	UDP
Jun 4 21:15:23	WAN	118.89.36.132:48806	108.77.84.186:6379	TCP:S
Jun 4 21:15:06	WAN	35.157.23.15:32099	108.77.84.186:37306	UDP
Jun 4 21:15:06	WAN	52.8.254.146:32099	108.77.84.186:64725	UDP
Jun 4 21:15:06	WAN	34.196.55.206:32099	108.77.84.186:26214	UDP
Jun 4 21:14:49	WAN	46.161.27.30:36391	108.77.84.186:8545	TCP:S

The IP belongs to lightspeed.sbcglobal.net which is a division of AT&T. Should I create a rule to pass this traffic? Could really use some advice from someone who understands this better than me. I've had constant issues with connectivity since switching to AT&T and wondering if this might be the problem.

johnpoz

No I would not open those up..

There is a lot of NOISE on the internet.. If you do not want to see it all then I would suggest you turn off logging and only setup the logging you wan to see... I just log tcp syn for example

Jun 4 21:15:23 WAN 118.89.36.132:48806 108.77.84.186:6379 TCP:S
Jun 4 21:14:49 WAN 46.161.27.30:36391 108.77.84.186:8545 TCP:S

6379 is redis port, many exploits out there for that. So lots of noise of bots and scripts looking for machines to also exploit that have these services open.

8545 is default JSON rpc port - again something looking to exploit something else most likely.

The ONLY ports you should open on your wan is something you specifically WANT to allow.. Ping maybe if you want to be able to ping your wan IP form the outside.

All it means that the IP is sbcglobal/AT&T other user - just like yourself, etc.

kpa

Turn off default logging at Status->Settings->Log firewall default blocks, you absolutely don't want to keep that option on if you want to log anything that is actually interesting.

wgstarks

@kpa said in firewall configuration question:

Turn off default logging at Status->Settings->Log firewall default blocks, you absolutely don't want to keep that option on if you want to log anything that is actually interesting.

Logging for all the default block rules is already off in the general settings as well as the settings for firewall log. Makes me wonder why these blocks are getting logged. Is there another setting somewhere else?

johnpoz

The log will show you what rule logged it.. What does it say?

wgstarks

Found the problem. For some reason I had set the default block rule to log blocks. Fixed now. Thanks for the help.