Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just installed CSF firewall on my server and I have started seeing the following entries in my log file. Can some one help me understanding as to what is happening

Thanks

Feb 25 10:45:19 li235-57 kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=fe:fd:ad:ff:e1:39:88:43:e1:7c:75:3f:08:00 SRC=81.4.153.90 DST=173.255.225.57 LEN=48 TOS=0x00 PREC=0x00 TTL=116 ID=58295 DF PROTO=TCP SPT=43639 DPT=4899 WINDOW=65535 RES=0x00 SYN URGP=0 
Feb 25 10:45:22 li235-57 kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=fe:fd:ad:ff:e1:39:88:43:e1:7c:75:3f:08:00 SRC=81.4.153.90 DST=173.255.225.57 LEN=48 TOS=0x00 PREC=0x00 TTL=116 ID=58483 DF PROTO=TCP SPT=43639 DPT=4899 WINDOW=65535 RES=0x00 SYN URGP=0 
Feb 25 10:55:51 li235-57 kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT= MAC=fe:fd:ad:ff:e1:39:88:43:e1:7c:75:3f:08:00 SRC=82.178.69.36 DST=173.255.225.57 LEN=50 TOS=0x00 PREC=0x00 TTL=108 ID=3839 DF PROTO=UDP SPT=52904 DPT=80 LEN=30 
Feb 25 10:58:04 li235-57 kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT= MAC=fe:fd:ad:ff:e1:39:88:43:e1:7c:75:3f:08:00 SRC=82.178.182.44 DST=173.255.225.57 LEN=55 TOS=0x00 PREC=0x00 TTL=47 ID=54421 DF PROTO=UDP SPT=53915 DPT=80 LEN=35 
share|improve this question

1 Answer 1

this means it has blocked the following 3 ip's for the respective reasons

81.4.153.90 connecting to port 4899 on tcp 82.178.69.36 connecting to port 80 via UDP 82.178.182.44 connecting to port 80 via UDP

from my knowledge a webserver doesnt run on UDP ports hence why your firewall will block UDP 80

these are blocked because CSF will generally block IP's that try to connect multiple times to same non open port

share|improve this answer
    
its worth pointing out that the key tags to look for are: SRC= and PROTO= and DPT= –  anthonysomerset Feb 25 '11 at 11:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.