0

I was going through my daily morning firewall report and saw these rules strange rules

Chain OUTPUT (policy ACCEPT 40383 packets, 7815K bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1     4365  444K DROP       icmp --  any    any    !127.68.53.96        !127.81.42.69         icmp port-unreachable connmark match ! 0x7b2ff1ce
2     2880  115K DROP       tcp  --  any    any    !127.36.111.188      !127.182.29.205       tcp spts:61001:65535 flags:RST/RST connmark match ! 0x72dcd57d

They're in the 127.0.0.0/8 range so they're in the loopback address range. They're oddly specific though. My server auto patches itself every morning at 7:30am. The only services that aren't patched are softether vpn. It also runs my own voip server but that runs in its own account. These rules weren't there in yesterday's daily morning firewall report. I have fail2ban running but this doesn't seem like a likely source. My other firewall rules haven't been touched.

What does this mean for me?

Improve this question

1 Answer 1

Reset to default
0

It was softether as seen here (see lines 571-581). Totally legitimate.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .