1

I use iptables to log all incoming connections. While going through the log in var/log/messages, I notice that there are some incoming connections from another computer to an unassigned LAN ip address, example:

Jan 7 23:31:28 some kernel: [ 1863.117105] IPTABLES: IN=wlan0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:12:34:56:e1:e1:08:00 SRC=192.168.1.12 DST=192.168.1.255 LEN=239 TOS=0x00 PREC=0x00 TTL=128 ID=37 PROTO=UDP SPT=138 DPT=138 LEN=219

My question is, if these connections are not destined to my server, why are they logged under INPUT? If they are being logged, does it mean that my server is accepting them if I do not filter out these explicitly? My current iptables configuration is:

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j LOG --log-prefix "IPTABLES: " --log-level info
-A INPUT -p icmp -j ACCEPT
-A INPUT -p tcp --dport 80 -j ACCEPT

Does it mean that I have to add a -d to the last rule as in:

-A INPUT -p tcp -d 192.168.1.1 --dport 80 -j ACCEPT

to filter out connections not destined to my server?

2 Answers 2

4

That is logging a packet to 192.168.2.255, assuming yoy have a 24 bitsubnet mask, then that means it is the broadcast adress. Broadcasts get sent to every computer on the network.

This particular packet is almost certainly a windows machine annoucing its name to the network.

0
3

Presuming that your using a /24 network then your system is accepting that packet because it's to the 192.168.1/24 broadcast address 192.168.1.255 this would be normal.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .