Lots of 60001 drops

Hi, Arjun, and welcome to the UTM Community!

Those are normal drops.  If you don't want them in your log file, you can make a firewall rule dropping them silently.

Cheers - Bob

Hi Arjun Naha,

Do you know if you have multicast enabled? The destination IP address in your log extract relates to multicast.

Regards,

Richard

Hi Bob and Richard,

I managed to setup a rule to drop packets without logging them.

I've come across another problem, having had looked at the logs.

2017:01:23-00:19:20 utm ulogd[4873]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="18:62:2c:70:xx:xx" dstmac="94:18:82:38:xx:xx" srcip="65.20.0.43" dstip="192.168.1.100" proto="6" length="40" tos="0x00" prec="0x00" ttl="248" srcport="993" dstport="46048" tcpflags="ACK RST"

2017:01:23-00:29:14 utm ulogd[4873]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="88:63:df:9e:xx:xx" dstmac="94:18:82:38:xx:xx" srcip="192.168.1.64" dstip="192.168.1.100" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="4242" dstport="63096" tcpflags="RST"

2017:01:23-00:33:24 utm ulogd[4873]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="18:62:2c:70:xx:xx" dstmac="94:18:82:38:xx:xx" srcip="65.20.0.43" dstip="192.168.1.100" proto="6" length="40" tos="0x00" prec="0x00" ttl="248" srcport="993" dstport="51278" tcpflags="ACK RST"

2017:01:23-00:49:28 utm ulogd[4873]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="18:62:2c:70:xx:xx" dstmac="94:18:82:38:xx:xx" srcip="65.20.0.43" dstip="192.168.1.100" proto="6" length="40" tos="0x00" prec="0x00" ttl="248" srcport="993" dstport="52704" tcpflags="ACK RST"

I don't know how these are getting into the network, since my Home Hub firewall is active and there is no port forwarding to my UTM enabled. Recently, I've also been having problems with BBC iPlayer videos not working, which is definitely something to do with the UTM, since I didn't have this problem before. There are also connections from devices on the Home Hub on 192.168.1.x being dropped (192.168.1.100 is the UTM). All ports are open outbound (I know this is bad security practice, but opening up ports for the applications I use would be quite tiresome), so still think there is something with my double NAT setup.

Thanks,

Arjun

Hi Arjun,

The source IP in your log extract "65.20.0.43", resolves to "mail.btinternet.bt.lon5.cpcloud.co.uk". Do you use any e-mail clients which aren't web-based, to access your e-mail?

Regards,

Richard

Arjun, sometimes the UTM decides that a connection is finished before the other server decides it's done - that's why you're seeing ACK and ACK RST packets dropped.  Neither is really doing anything wrong here - it's just meaningless noise that you should ignore.

Cheers - Bob

Hi Richard,

Yes, I do use that mail server but not any problems with it recently.

Still can't get iPlayer to work, and non of the IP's in the firewall log seem to correlate to any BBC servers.