This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

fwrule 60023

SvenSchuchmann over 4 years ago

Hi,

does someone know what is creating fwrule="60023" in the packetfilter.log?

cu SveN

This thread was automatically locked due to age.

Parents

0 Alexander Busch over 4 years ago

Hi SveN,

in https://community.sophos.com/kb/en-us/115029 60023 isn’t listed. Any more hint in the log line? Maybe anything from IPS, but just a guess.

Best regards

Alex

-
Cancel
Vote Up 0 Vote Down

Cancel

0 SvenSchuchmann over 4 years ago in reply to Alexander Busch

Hi Alexander,

no, nothing more in the log, just:

2020:03:20-10:20:52 mail ulogd[15773]: id="2001" severity="info" sys="SecureNet" 
   sub="packetfilter" name="Packet dropped" action="drop" fwrule="60023" 
   initf="reds8" srcmac="XX:XX:XX:XX:XX:XX" dstmac="XX:XX:XX:XX:XX:XX" srcip="10.242.113.137" dstip="10.242.113.1" 
   proto="17" length="59" tos="0x00" prec="0x00" ttl="128" srcport="57830" dstport="53"

cu SveN

0 Alexander Busch over 4 years ago in reply to SvenSchuchmann

Hey SveN,

so I see it’s UDP and Port 53, so DNS. As destination IP is 10.242.113.1 It’s in your net. Is UTM provide DNS on that Address? If not that may be blocked. Maybe 60023 is blocked DNS requests???
But maybe someone knows more about that.

Best regards

Alex

-
Cancel
Vote Up 0 Vote Down

Cancel
0 SvenSchuchmann over 4 years ago in reply to Alexander Busch

Hello Alex,

thanks, yes it is DNS, yes it is internal IP comming from a RED Device,
the DNS-Server allows connections from that IP-Net (RED Device)
but somehow it got blocked and I would like to know what is
causing this...

cu SveN
Cancel
Vote Up 0 Vote Down

Cancel
0 Alexander Busch over 4 years ago in reply to SvenSchuchmann

Does the blocking occurs if you turn IPS off? A firewall rule for allowing this traffic is in place?

-
Cancel
Vote Up 0 Vote Down

Cancel
0 SvenSchuchmann over 4 years ago in reply to Alexander Busch

Hi Alex,

this IP got blocked "suddenly". So there is a rule in Place.
All other clients from this subnet were able to connect.

I turned IPS off, but no luck, IP got still blocked.
I do not know if turning IPS off is immediately resetting
all its filters... So it might be IPS...

I would expect to find this somehwere in the documentation,
since it would make live much easier. Also I a missing how
to disable this rule immediately, because it caused a lot of trouble...

cu SveN
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 SvenSchuchmann over 4 years ago in reply to Alexander Busch

Hi Alex,

this IP got blocked "suddenly". So there is a rule in Place.
All other clients from this subnet were able to connect.

I turned IPS off, but no luck, IP got still blocked.
I do not know if turning IPS off is immediately resetting
all its filters... So it might be IPS...

I would expect to find this somehwere in the documentation,
since it would make live much easier. Also I a missing how
to disable this rule immediately, because it caused a lot of trouble...

cu SveN
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data