I am running a VPS server (Linux CentOS) to provide web hosting for my clients.
Yesterday, one of my clients got blocked out by the LFD firewall on my server:
I got a server admin email notification with the following subject line:
lfd on vps.audetwebhosting.net: 18.104.22.168 (US/United States/c-24-2-190-167.hsd1.ct.comcast.net) blocked for port scanning
and the body contained lines like:
Time: Sun Mar 31 11:29:35 2013 -0400 IP: 22.214.171.124 (US/United States/c-24-2-190-167.hsd1.ct.comcast.net) Hits: 11 Blocked: Temporary Block Sample of block hits: Mar 31 11:28:22 vps kernel: [2760494.944535] Firewall: *TCP_IN Blocked* IN=venet0 OUT= MAC= SRC=126.96.36.199 DST=188.8.131.52 LEN=64 TOS=0x00 PREC=0x00 TTL=48 ID=14772 DF PROTO=TCP SPT=50780 DPT=587 WINDOW=65535 RES=0x00 SYN URGP=0 Mar 31 11:28:23 vps kernel: [2760496.050542] Firewall: *TCP_IN Blocked* IN=venet0 OUT= MAC= SRC=184.108.40.206 DST=220.127.116.11 LEN=64 TOS=0x00 PREC=0x00 TTL=48 ID=28408 DF PROTO=TCP SPT=50780 DPT=587 WINDOW=65535 RES=0x00 SYN URGP=0
My client is not all that tech savvy so I don't think that they would just casually run a port scan on their Mac laptop.
I am guessing about what might have happened:
(1) Client laptop has a virus that is doing a port scan
(2) Client opened the console window and tried to ping their website
(3) Some hacker is squatting on cleint WiFi connection
(4) Client visited a website with some has a web app that does a port scan
(5) Client has some firewall/anti-malware software that may be doing a port scan
(6) Client has a router that scans ports
I am wondering, how someone could accidentally trigger a port scan type of response from the firewall?
I am a web programmer not a Linux guru, so I am not even sure how to best ask this question. Thank you for your patience.