New install, what is going on here?
-
I am seeing in my logs the following info which is freaking me out.
Firewall logs:
May 17 07:28:45 WAN 61.240.144.65:60000 184.13.31.65:53 UDP
May 17 07:30:05 WAN 61.240.144.66:60000 184.13.31.65:1900 UDPI am also seeing a constant flash on my pFsense network adaptor, every 2 seconds, my RRD Graphics is constant on the WAN adaptor with low speed traffic.
This firewall is not really in use as of yet, I have one machine attached to it for setting up, now the above IP is coming from China, I have also seen Japan showing up also.
Why is the default firewall rule allowing this, or is it blocking it?. Why is someone in china trying port 53 which is a DNS request via my machine to my ISPs DNS server?
-
Oh noes, you are seeing blocked internet traffic on your firewall?!
Hopefully disabling the logging will make you feel better? :P
-
Thanks for that, so what I am seeing is attempts to use my network as a proxy for someone to gain access to something on another network!
I just find it weird that I can change my PPoE IP address, and within seconds they are trying it again. Well, I guess pFSense is doing its job, that makes me happy :)
-
Port 53 and 1900 are DNS and uPNP. Someone probably has their network wide open and you're getting broadcasted packets or something.
-
Port 53 and 1900 are DNS and uPNP. Someone probably has their network wide open and you're getting broadcasted packets or something.
That would make sense, seeing as both modems are DSL PPoE setups. I just installed and setup PFBlocker, setup some country rules and I no longer see them in my logs!.
I like to check my logs, I want to see whom or what is trying to access my network. It would seem that PFSense is not allowing anyone access unless I mess up! lol
-
I did find some interesting information on UPnP that I was not aware of….. UPnP has some serious flaws in it, and it is advised that it is disabled in your routers.
http://www.zdnet.com/article/how-to-fix-the-upnp-security-holes/