Thread Info
  • State Verified Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 29 replies
  • Subscribers 7 subscribers
  • Views 5100 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DNAT and IP-Filter do not block traffic

Chris69

Hi there,

today I really had to block traffic coming from a specific IP going to my UTM 9.705-3 trying massive IPSEC logins. 

Adding a firewall rule at #1 position did not work so I added a DNAT-rule to NAT all traffic coming from this IP going to my UTM to 240.x.x.x. and placed it on top of all NAT-rules.

But my IPSEC-log shows me that I am still flooded by this IP.

How can I protect my network when everything is passing my rules?

Thank you -

Chris

PS: 

And: why does an "iptables - L | grep IP-address" does not show my filter rule?



This thread was automatically locked due to age.
Parents
  • 0

    I have the same question. Need to block a full /24 brazil network that is spamming on our SG IPSec interface. DNAT and FW rules do not apply to this traffic.

    UTM should automatically block hosts that have more than a definded No of bad requests per minute.

    2021:03:11-15:25:59 fw-320-1 pluto[7019]: packet from 45.5.38.162:20640: not enough room in input packet for ISAKMP Message
    2021:03:11-15:25:59 fw-320-1 pluto[7019]: packet from 45.5.38.162:20640: sending notification PAYLOAD_MALFORMED to 45.5.38.162:20640
    2021:03:11-15:25:59 fw-320-1 pluto[7019]: packet from 45.5.38.199:39527: not enough room in input packet for ISAKMP Message
    2021:03:11-15:25:59 fw-320-1 pluto[7019]: packet from 45.5.38.199:39527: sending notification PAYLOAD_MALFORMED to 45.5.38.199:39527
    2021:03:11-15:26:00 fw-320-1 pluto[7019]: packet from 45.5.38.190:23302: not enough room in input packet for ISAKMP Message
    2021:03:11-15:26:00 fw-320-1 pluto[7019]: packet from 45.5.38.190:23302: sending notification PAYLOAD_MALFORMED to 45.5.38.190:23302
    2021:03:11-15:26:00 fw-320-1 pluto[7019]: packet from 45.5.38.214:20903: not enough room in input packet for ISAKMP Message
    2021:03:11-15:26:00 fw-320-1 pluto[7019]: packet from 45.5.38.214:20903: sending notification PAYLOAD_MALFORMED to 45.5.38.214:20903
    2021:03:11-15:26:00 fw-320-1 pluto[7019]: packet from 45.5.38.176:48768: not enough room in input packet for ISAKMP Message
    2021:03:11-15:26:00 fw-320-1 pluto[7019]: packet from 45.5.38.176:48768: sending notification PAYLOAD_MALFORMED to 45.5.38.176:48768
    2021:03:11-15:26:01 fw-320-1 pluto[7019]: packet from 45.5.38.205:20741: not enough room in input packet for ISAKMP Message
  • 0 in reply to LHerzog

    Hi LHerzog

    You have to create a DNAT roule AND Kill the Connections at the Firewall-Console (SSH) with e.g. "conntrack -D -s 45.5.38.176".
    Also, you need to do this for each IP Address in that /24 Network, i'm normaly using Excel to generate an IP List from 45.5.38.1 - 45.5.38.255 and then paste the Lines to CLI.

    Regards,

    Michael

  • 0 in reply to solae

    Mi Michael,

    but I will only kill existing connections with conntrack, right? So no way to keep them out permanently?

  • 0 in reply to LHerzog

    You will kill only existing Connections, but the DNAT rule will prevent new Connections.

Reply Children
No Data
Unfiltered HTML