0

FreeBSD this_server 10.3-RELEASE-p11 FreeBSD 10.3-RELEASE-p11 #0: Mon Oct 24 18:49:24 UTC 2016

IPFW seems to be full of ghosts for me. Here is an example.

First the evidence of blocking with my IP sanitized:

security.2.bz2:Feb  5 02:12:26 this_server kernel: ipfw: 552 Deny TCP 198.199.118.158:50479 xxx.xxx.xxx.xxx:110 in via vtnet0

The rule:

ipfw list | grep "552"
00552 deny log ip from table(1) to any dst-port 110

IPFW table dump zoomed (edited) into critical area:

ipfw table 1 list | sort -V | grep "198.1"

198.183.138.0/24 0
200.198.176.0/20 0

Thus the IP address is not range and shouldn't be blocked. This looks like a solid investigation to me, so I wonder if there is a bug in the virtualizing software.

3
  • Show ipfw list | grep 110
    – Kondybas
    Feb 5, 2017 at 8:03
  • # ipfw list | grep "110" 00552 deny log ip from table(1) to any dst-port 110 00561 deny log ip from table(2) to any dst-port 110 00568 deny log ip from table(3) to any dst-port 110
    – gariac
    Feb 6, 2017 at 5:24
  • I'm still fighting this. At the moment my firewall is blocking my desktop PC via rule 553, which is block on table My IP currently is 208.54.xxx.xxx. I went through the entire script that creates table 1 and comments out all lines that block IPs starting with 208. I can't figure out the comment formatting and when I use the "answer" to make a comment the bot complains about the answers not being useful. But trust me, there is no IP starting with 208 in table one, yet I'm being blocked. As a FYI when I try to start a new line the comment window gets closed.
    – gariac
    Feb 20, 2017 at 9:33

0

You must log in to answer this question.

Browse other questions tagged .