Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 14 replies
  • Subscribers 2 subscribers
  • Views 5746 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Unrecognized firewall log output

most_ahdy
Dear,
      I want to understand the attached output of the firewall log when I try to update Ubuntu 11.10 and this update related to Google Chrome.

Thanks,
Mostafa Aly


This thread was automatically locked due to age.
  • 0
    It looks like you have a block set for the Google Search application.  That's the Live Log, and it doesn't have much information in it.  Look at the same lines from the full Firewall log to learn more about what's happening.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0
    Hi Bob,
    Please find the same lines from full firewall log:

    2011:10:30-18:55:14 asg ulogd[5248]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" mark="0xb6" app="182" srcmac="0:50:4:b0[:D]7:8d" srcip="66.102.13.136" dstip="192.168.10.36" proto="6" length="301" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="57242" tcpflags="ACK PSH" 
    2011:10:30-18:55:14 asg ulogd[5248]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" mark="0xb6" app="182" srcmac="0:50:4:b0[:D]7:8d" srcip="66.102.13.136" dstip="192.168.10.36" proto="6" length="4396" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="57242" tcpflags="ACK" 
    2011:10:30-18:55:14 asg ulogd[5248]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" mark="0xb6" app="182" srcmac="0:50:4:b0[:D]7:8d" srcip="66.102.13.136" dstip="192.168.10.36" proto="6" length="4396" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="57242" tcpflags="ACK" 
    2011:10:30-18:55:15 asg ulogd[5248]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" mark="0xb6" app="182" srcmac="0:50:4:b0[:D]7:8d" srcip="66.102.13.136" dstip="192.168.10.36" proto="6" length="1500" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="57242" tcpflags="ACK PSH" 
    2011:10:30-18:55:15 asg ulogd[5248]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" mark="0xb6" app="182" srcmac="0:50:4:b0[:D]7:8d" srcip="66.102.13.136" dstip="192.168.10.36" proto="6" length="1500" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="57242" tcpflags="ACK PSH" 
    2011:10:30-18:55:16 asg ulogd[5248]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" mark="0xb6" app="182" srcmac="0:50:4:b0[:D]7:8d" srcip="66.102.13.136" dstip="192.168.10.36" proto="6" length="1500" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="57242" tcpflags="ACK PSH" 
    2011:10:30-18:55:18 asg ulogd[5248]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" mark="0xb6" app="182" srcmac="0:50:4:b0[:D]7:8d" srcip="66.102.13.136" dstip="192.168.10.36" proto="6" length="1500" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="57242" tcpflags="ACK PSH" 
    2011:10:30-18:55:21 asg ulogd[5248]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" mark="0xb6" app="182" srcmac="0:50:4:b0[:D]7:8d" srcip="66.102.13.136" dstip="192.168.10.36" proto="6" length="1500" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="57242" tcpflags="ACK PSH"

    Please I want something that explain to me all log output parameter like fwrule,id,mark,app

    Thanks,
    Mostafa
  • 0
    This demonstrates why it's always important to post the full log lines instead of the Live Log.  fwrule="60003" means this was dropped from the OUTPUT chain.  The fact that there's no in-interface (initf) indicates the packet comes from an Astaro proxy, and srcport="80" indicates that it's the http/s proxy.  There's no good reason for that to happen, so there must be a misconfiguration somewhere.

    Can you confirm that you have only a single Astaro NIC connected to your internal network?  If that's not the problem, then you probably need to go through your Host/Network definitions and set them all to 'Interface: >' instead of to a specific interface.

    Did any of that help?

    Cheers - Bob
    Please I want something that explain to me all log output parameter like fwrule,id,mark,app

    https://support.astaro.com/support/index.php/astaro_logfile_guide
    https://support.astaro.com/support/index.php/Packetfilter_logfiles
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0
    There is only one interface "eth0" connect to my internal network.
    you probably need to go through your Host/Network definitions and set them all to 'Interface: >' instead of to a specific interface

    May I know the reason for these changes before applying them?[:S]
  • 0
    Sometimes, for example, admins create a definition for use as the traffic selector destination in a DNAT, and that won't work unless the definition is bound to the target interface.  Instead of doing that, the admin should always use the "(Address)" object created by WebAdmin when the interface (or Additional Address) was created.

    Make sure that your DNATs don't use your manually-created definitions as the 'Destination' in the traffic selector portion of the rule.  Rather that you use "External (Address)" for example.  Similarly, in your other NATs, make sure an "(Address)" object is used wherever possible.

    Binding a definition you create to a specific interface can generate strange problems.  The only real reason an admin would want to bind definitions to an Interface would be to eliiminate a spoofing problem.  If you have spoofing protection enabled ('Firewall' 'Advanced' tab), there's never a reason to bind a definition to an interface in a definition you create.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0
    Thanks Bob. I know this is an old post. But I was recently seeing the same thing (and had bound a few definitions to some interfaces). Now I know better!
  • 0
    Sorry to raise this from the dead, but I'm getting the same errors in my firewall log.  I have several devices on the network but it seems to only be dropping the packets meant for one desktop.  On that desktop, browsing is now very hit or miss and I have to refresh the pages a lot for things to load.  On an ipad or something else it's all good.  I have all my devices using static DHCP mapping and I've made sure the interface is on "any".  I'm only doing the common nat masquerading for addresses (no DNAT).  I also don't really see any difference when I turn the content filter off or when I enable an All external -> internal allow rule (I only have it on for short periods for testing).  Any ideas?
  • 0
    Hi,

    Please post entries from the full logs.

    Barry
  • 0
    Here is a clip from the log.  I was wrong, this does appear to be affecting other machines on the network.

    2014:05:13-02:32:51 Clamshell ulogd[15288]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" srcmac="0:21:70:7a[:D]:b" srcip="174.35.38.108" dstip="192.168.11.39" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="46369" tcpflags="RST" 
    2014:05:13-02:32:51 Clamshell ulogd[15288]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" srcmac="0:21:70:7a[:D]:b" srcip="174.35.38.108" dstip="192.168.11.39" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="46369" tcpflags="RST" 
    2014:05:13-02:32:52 Clamshell ulogd[15288]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" srcmac="0:21:70:7a[:D]:b" srcip="174.35.38.108" dstip="192.168.11.39" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="46369" tcpflags="RST" 
    2014:05:13-02:32:54 Clamshell ulogd[15288]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" srcmac="0:21:70:7a[:D]:b" srcip="174.35.38.108" dstip="192.168.11.39" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="46369" tcpflags="RST" 
    2014:05:13-02:32:57 Clamshell ulogd[15288]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" srcmac="0:21:70:7a[:D]:b" srcip="174.35.38.108" dstip="192.168.11.39" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="46369" tcpflags="RST" 
    2014:05:13-02:33:03 Clamshell ulogd[15288]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" srcmac="0:21:70:7a[:D]:b" srcip="174.35.38.108" dstip="192.168.11.39" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="46369" tcpflags="RST" 
    2014:05:13-02:33:15 Clamshell ulogd[15288]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" srcmac="0:21:70:7a[:D]:b" srcip="174.35.38.108" dstip="192.168.11.39" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="46369" tcpflags="RST" 
    2014:05:13-02:33:38 Clamshell ulogd[15288]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" srcmac="0:21:70:7a[:D]:b" srcip="174.35.38.108" dstip="192.168.11.39" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="46369" tcpflags="RST" 
    2014:05:13-02:34:26 Clamshell ulogd[15288]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" srcmac="0:21:70:7a[:D]:b" srcip="174.35.38.108" dstip="192.168.11.39" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="46369" tcpflags="RST"
  • 0
    Hi, 

    RST (reset) packets dropping are usually red herrings.

    1. Do you see any SYN packets dropped?

    2. Are you using the http proxy (Web Protection)? 
    If so, check its log.

    3. also check the IPS and application control logs.

    Barry
Unfiltered HTML