1

I use ufw utility to manage my firewall for the system which runs web and mail services. The rules are follow:

Status: active

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere
80                         ALLOW       Anywhere
443                        ALLOW       Anywhere
143                        ALLOW       Anywhere
993                        ALLOW       Anywhere
25/tcp                     ALLOW       Anywhere
587                        ALLOW       Anywhere
...

22/tcp (v6)                ALLOW       Anywhere (v6)
80 (v6)                    ALLOW       Anywhere (v6)
443 (v6)                   ALLOW       Anywhere (v6)
143 (v6)                   ALLOW       Anywhere (v6)
993 (v6)                   ALLOW       Anywhere (v6)
25/tcp (v6)                ALLOW       Anywhere (v6)
587 (v6)                   ALLOW       Anywhere (v6)

But in log files there are a lot of messages of blocked packets to the permitted ports, like:

kernel: [...] [UFW BLOCK] IN=eth0 OUT= MAC=...:83:08:00 SRC=[sourceIP] 
DST=[myIP] LEN=40 TOS=0x00 PREC=0x00 TTL=52 ID=811 PROTO=TCP SPT=21766 
DPT=80 WINDOW=0 RES=0x00 ACK RST URGP=0

or:

kernel: [...] [UFW BLOCK] IN=eth0 OUT= MAC=...:08:00 SRC=[sourceIP] 
DST=[myIP] LEN=40 TOS=0x00 PREC=0x00 TTL=118 ID=1150 PROTO=TCP SPT=56818
DPT=993 WINDOW=1525 RES=0x00 ACK URGP=0

I do not have any restrictions of firewall for the incoming IP addresses, so what is the reason of such blocks and is there a way to fix it. Thanks a lot.

  • Found related issue caused by disabled syncoockies: serverfault.com/questions/338393/ – Ver Dec 18 '17 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.