Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 38 replies
  • Answers 3 answers
  • Subscribers 5 subscribers
  • Views 42198 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Drop packages

AreshAreshi

Hi,

 

We have a DNAT rule that allow us to access our server with RDP from internet with different port number, the rule working correctly, but in the logs we can see lots of drop UDP connections from the the IP address and port number that we try to access the server with RDP.

what are these UDP packages? why should the we see incoming UDP packages at all?



This thread was automatically locked due to age.
Parents
  • 0

    Aresh, alone among the logs, the Firewall Live Log presents abbreviated information in a format easier to read quickly.  Usually, you can't troubleshoot without looking at the corresponding line from the full Firewall log file.  Please post one line corresponding to those above.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Hi Bob,

     

    Thanks for the reply,

    I already check the Firewall log and I have to say I cannot find any extra information, this is the firewall log that corresponding to the live logs,

    Also I cannot see that droped packages are udp. or I am looking in the wrong logs?

    2017:02:07-14:39:03 securitysrv1-1 ulogd[11961]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="54:e0:XX:XX:76:9a" dstmac="00:1a:XX:f0:XX:a0" srcip="132.XX.XX.2" dstip="62.XX.XX.184" proto="17" length="1260" tos="0x00" prec="0x00" ttl="119" srcport="51822" dstport="4012"

     

    Thanks

  • 0 in reply to AreshAreshi

    That was the other possibility as UThomas suggested.  Make a new Service with TCP/UDP and you'll be golden.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    I will do that and let you know the result.

  • 0 in reply to BAlfson

    HI,

    I did create a new service object for the port nummer but when try to use it in my nat rule get this error:

     is this means that I should also create a custom service object for "Add The service TO" ?

     

    Any idea?

  • 0 in reply to AreshAreshi

    Both the source Service and the change-to Service must be TCP/UDP.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Hi,

    sorry for the delay, finaly I get the chance to run a test,

    I did create 2 servicedefinition for a port forwarding to a server 2012 R2 in our network, both service definitions has TCP/UDP.

    Now when access the server with RDP we see some changes in the firewall logs, but it looks like that the internal server still droping the UDP packages. I did disable the local Windows Firewall but still the same issue. it look like that Remote desktop on the server dont use UDP.

    Any suggestion?

     

  • 0 in reply to AreshAreshi

    Alone among the logs, the Firewall Live Log presents abbreviated information in a format easier to read quickly.  Usually, you can't troubleshoot without looking at the corresponding line from the full Firewall log file.  Please post one line corresponding to those UDP blocks above.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    sorry for that,

    this is the full FW log:

     

    2017:03:28-13:36:33 securitysrv1-2 ulogd[18968]: id="2000" severity="info" sys="SecureNet" sub="packetfilter" name="Packet logged" action="log" fwrule="62005" initf="eth0" srcmac="54:e0:52:07:76:9a" dstmac="00:1a:9c:f1:0f:a0" srcip="217.XX.XX.30" dstip="62.XX.XX.184" proto="6" length="52" tos="0x00" prec="0x00" ttl="119" srcport="54085" dstport="4002" tcpflags="SYN"
    2017:03:28-13:36:33 securitysrv1-2 ulogd[18968]: id="2000" severity="info" sys="SecureNet" sub="packetfilter" name="Packet logged" action="log" fwrule="62005" initf="eth0" srcmac="54:e0:52:07:76:9a" dstmac="00:1a:9c:f1:0f:a0" srcip="217.XX.XX.30" dstip="62.XX.XX.184" proto="17" length="1260" tos="0x00" prec="0x00" ttl="119" srcport="61972" dstport="4002"
    2017:03:28-13:36:33 securitysrv1-2 ulogd[18968]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" initf="eth0" outitf="eth0" srcmac="54:e0:52:07:76:9a" dstmac="00:1a:9c:f1:0f:a0" srcip="217.XX.XX.30" dstip="10.0.10.205" proto="17" length="1260" tos="0x00" prec="0x00" ttl="118" srcport="61972" dstport="3389"
    2017:03:28-13:36:34 securitysrv1-2 ulogd[18968]: id="2000" severity="info" sys="SecureNet" sub="packetfilter" name="Packet logged" action="log" fwrule="62005" initf="eth0" srcmac="54:e0:52:07:76:9a" dstmac="00:1a:9c:f1:0f:a0" srcip="217.XX.XX.30" dstip="62.XX.XX.184" proto="17" length="1260" tos="0x00" prec="0x00" ttl="119" srcport="61973" dstport="4002"
    2017:03:28-13:36:34 securitysrv1-2 ulogd[18968]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" initf="eth0" outitf="eth0" srcmac="54:e0:52:07:76:9a" dstmac="00:1a:9c:f1:0f:a0" srcip="217.XX.XX.30" dstip="10.0.10.205" proto="17" length="1260" tos="0x00" prec="0x00" ttl="118" srcport="61973" dstport="3389"
    2017:03:28-13:36:34 securitysrv1-2 ulogd[18968]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="54:e0:52:07:76:9a" dstmac="00:1a:9c:f1:0f:a0" srcip="116.232.154.173" dstip="62.221.199.196" proto="6" length="44" tos="0x00" prec="0x00" ttl="49" srcport="24828" dstport="23" tcpflags="SYN"
    2017:03:28-13:36:35 securitysrv1-2 ulogd[18968]: id="2000" severity="info" sys="SecureNet" sub="packetfilter" name="Packet logged" action="log" fwrule="62005" initf="eth0" srcmac="54:e0:52:07:76:9a" dstmac="00:1a:9c:f1:0f:a0" srcip="217.XX.XX.30" dstip="62.XX.XX.184" proto="17" length="1260" tos="0x00" prec="0x00" ttl="119" srcport="61972" dstport="4002"
    2017:03:28-13:36:35 securitysrv1-2 ulogd[18968]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" initf="eth0" outitf="eth0" srcmac="54:e0:52:07:76:9a" dstmac="00:1a:9c:f1:0f:a0" srcip="217.XX.XX.30" dstip="10.0.10.205" proto="17" length="1260" tos="0x00" prec="0x00" ttl="118" srcport="61972" dstport="3389"
    2017:03:28-13:36:36 securitysrv1-2 ulogd[18968]: id="2000" severity="info" sys="SecureNet" sub="packetfilter" name="Packet logged" action="log" fwrule="62005" initf="eth0" srcmac="54:e0:52:07:76:9a" dstmac="00:1a:9c:f1:0f:a0" srcip="217.XX.XX.30" dstip="62.XX.XX.184" proto="17" length="1260" tos="0x00" prec="0x00" ttl="119" srcport="61973" dstport="4002"
    2017:03:28-13:36:36 securitysrv1-2 ulogd[18968]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" initf="eth0" outitf="eth0" srcmac="54:e0:52:07:76:9a" dstmac="00:1a:9c:f1:0f:a0" srcip="217.XX.XX.30" dstip="10.0.10.205" proto="17" length="1260" tos="0x00" prec="0x00" ttl="118" srcport="61973" dstport="3389"
    2017:03:28-13:36:38 securitysrv1-2 ulogd[18968]: id="2000" severity="info" sys="SecureNet" sub="packetfilter" name="Packet logged" action="log" fwrule="62005" initf="eth0" srcmac="54:e0:52:07:76:9a" dstmac="00:1a:9c:f1:0f:a0" srcip="217.XX.XX.30" dstip="62.XX.XX.184" proto="17" length="1260" tos="0x00" prec="0x00" ttl="119" srcport="61972" dstport="4002"
    2017:03:28-13:36:38 securitysrv1-2 ulogd[18968]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" initf="eth0" outitf="eth0" srcmac="54:e0:52:07:76:9a" dstmac="00:1a:9c:f1:0f:a0" srcip="217.XX.XX.30" dstip="10.0.10.205" proto="17" length="1260" tos="0x00" prec="0x00" ttl="118" srcport="61972" dstport="3389"
    2017:03:28-13:36:39 securitysrv1-2 ulogd[18968]: id="2000" severity="info" sys="SecureNet" sub="packetfilter" name="Packet logged" action="log" fwrule="62005" initf="eth0" srcmac="54:e0:52:07:76:9a" dstmac="00:1a:9c:f1:0f:a0" srcip="217.XX.XX.30" dstip="62.XX.XX.184" proto="17" length="1260" tos="0x00" prec="0x00" ttl="119" srcport="61973" dstport="4002"
    2017:03:28-13:36:39 securitysrv1-2 ulogd[18968]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" initf="eth0" outitf="eth0" srcmac="54:e0:52:07:76:9a" dstmac="00:1a:9c:f1:0f:a0" srcip="217.XX.XX.30" dstip="10.0.10.205" proto="17" length="1260" tos="0x00" prec="0x00" ttl="118" srcport="61973" dstport="3389"

  • 0 in reply to AreshAreshi

    None of those lines correspond to the ones in your first post above.  Please show one of the lines from 14:39:00.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    In my opinion there is something wrong with the NAT rule. The first two entries look like a correct connection (first tcp, then udp) but these packets are not NATed. The hits on the firewall should point to the internal IP of the server, not the external of the UTM. Those packets that contain the internal IP contain a wrong port.

    Anyway, I'm no friend of such RDP 'solutions' via NATing a bunch of ports to the internal LAN.

    Over RD Gateway it only needs one port open and a certificate, over VPN is the preferable way to connect to internal resources - in my opinion...

    Gruß / Regards,

    Kevin
    Sophos CE/CA (XG+UTM), Gold Partner

  • 0 in reply to BAlfson

    Hi,

    I think you are mistaking and looking at the wrong screenshot, the screenshot at the top of the page is from my fist post and is old, it is from the time that I did not still open the udp port.

    if you go to the page one at the end of the page you will see my last screenshot and the time is exactly corresponding with the last FW logs.

     

    Thanks

Reply
  • 0 in reply to BAlfson

    Hi,

    I think you are mistaking and looking at the wrong screenshot, the screenshot at the top of the page is from my fist post and is old, it is from the time that I did not still open the udp port.

    if you go to the page one at the end of the page you will see my last screenshot and the time is exactly corresponding with the last FW logs.

     

    Thanks

Children
No Data
Unfiltered HTML