firewall configuration question
-
I just recently switched to AT&T U-Verse fiber and since then I've been seeing large numbers of blocks in my firewall log, all with the same IP.
Just a small sample-
Jun 4 21:18:02 WAN 52.8.254.146:32099 108.77.84.186:64725 UDP Jun 4 21:18:02 WAN 34.196.55.206:32099 108.77.84.186:26214 UDP Jun 4 21:17:18 WAN 35.157.23.15:32099 108.77.84.186:37306 UDP Jun 4 21:17:18 WAN 52.8.254.146:32099 108.77.84.186:64725 UDP Jun 4 21:17:18 WAN 34.196.55.206:32099 108.77.84.186:26214 UDP Jun 4 21:16:34 WAN 35.157.23.15:32099 108.77.84.186:37306 UDP Jun 4 21:16:34 WAN 52.8.254.146:32099 108.77.84.186:64725 UDP Jun 4 21:16:34 WAN 34.196.55.206:32099 108.77.84.186:26214 UDP Jun 4 21:15:50 WAN 35.157.23.15:32099 108.77.84.186:37306 UDP Jun 4 21:15:50 WAN 52.8.254.146:32099 108.77.84.186:64725 UDP Jun 4 21:15:49 WAN 34.196.55.206:32099 108.77.84.186:26214 UDP Jun 4 21:15:23 WAN 118.89.36.132:48806 108.77.84.186:6379 TCP:S Jun 4 21:15:06 WAN 35.157.23.15:32099 108.77.84.186:37306 UDP Jun 4 21:15:06 WAN 52.8.254.146:32099 108.77.84.186:64725 UDP Jun 4 21:15:06 WAN 34.196.55.206:32099 108.77.84.186:26214 UDP Jun 4 21:14:49 WAN 46.161.27.30:36391 108.77.84.186:8545 TCP:S
The IP belongs to lightspeed.sbcglobal.net which is a division of AT&T. Should I create a rule to pass this traffic? Could really use some advice from someone who understands this better than me. I've had constant issues with connectivity since switching to AT&T and wondering if this might be the problem.
-
No I would not open those up..
There is a lot of NOISE on the internet.. If you do not want to see it all then I would suggest you turn off logging and only setup the logging you wan to see... I just log tcp syn for example
Jun 4 21:15:23 WAN 118.89.36.132:48806 108.77.84.186:6379 TCP:S
Jun 4 21:14:49 WAN 46.161.27.30:36391 108.77.84.186:8545 TCP:S6379 is redis port, many exploits out there for that. So lots of noise of bots and scripts looking for machines to also exploit that have these services open.
8545 is default JSON rpc port - again something looking to exploit something else most likely.
The ONLY ports you should open on your wan is something you specifically WANT to allow.. Ping maybe if you want to be able to ping your wan IP form the outside.
All it means that the IP is sbcglobal/AT&T other user - just like yourself, etc.
-
Turn off default logging at Status->Settings->Log firewall default blocks, you absolutely don't want to keep that option on if you want to log anything that is actually interesting.
-
@kpa said in firewall configuration question:
Turn off default logging at Status->Settings->Log firewall default blocks, you absolutely don't want to keep that option on if you want to log anything that is actually interesting.
Logging for all the default block rules is already off in the general settings as well as the settings for firewall log. Makes me wonder why these blocks are getting logged. Is there another setting somewhere else?
-
The log will show you what rule logged it.. What does it say?
-
Found the problem. For some reason I had set the default block rule to log blocks. Fixed now. Thanks for the help.