/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */
Hi all,
I'm very concerned about strange ICQ behavior. Let me describe my
situation.
I have two local network masqueraded by Linux Router box to our ISP
and hence Internet. Whenever someone of my client from LANs sends an
ICQ message I has four packets from recipient in return. This packets
are dropped by firewall rules, because trying to connect to non-masqed
ports. That is a TCP connection trying to reach my firewall.
<exrpt from syslog>
Feb 15 09:10:14 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.168:1176
212.42.34.167:29626 L=44 S=0x00 I=37894 F=0x0040 T=24
Feb 15 09:10:16 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.168:1176
212.42.34.167:29626 L=44 S=0x00 I=39174 F=0x0040 T=24
Feb 15 09:10:22 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.168:1176
212.42.34.167:29626 L=44 S=0x00 I=39942 F=0x0040 T=24
Feb 15 09:10:35 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.168:1176
212.42.34.167:29626 L=44 S=0x00 I=43526 F=0x0040 T=24
Feb 15 09:13:15 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.168:1180
212.42.34.167:29626 L=44 S=0x00 I=49414 F=0x0040 T=24
Feb 15 09:13:18 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.168:1180
212.42.34.167:29626 L=44 S=0x00 I=49670 F=0x0040 T=24
Feb 15 09:13:24 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.168:1180
212.42.34.167:29626 L=44 S=0x00 I=49926 F=0x0040 T=24
Feb 15 09:13:37 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.168:1180
212.42.34.167:29626 L=44 S=0x00 I=50694 F=0x0040 T=24
Feb 15 09:32:57 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.220:1032
212.42.34.167:29626 L=64 S=0xC4 I=16128 F=0x0040 T=120
Feb 15 09:33:00 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.220:1032
212.42.34.167:29626 L=64 S=0xC4 I=17408 F=0x0040 T=120
Feb 15 09:33:07 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.220:1032
212.42.34.167:29626 L=64 S=0xC4 I=18432 F=0x0040 T=120
Feb 15 09:33:18 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.220:1032
212.42.34.167:29626 L=64 S=0xC4 I=18944 F=0x0040 T=120
Feb 15 09:47:54 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.168:1564
212.42.34.167:29626 L=44 S=0x00 I=33811 F=0x0040 T=24
Feb 15 09:47:57 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.168:1564
212.42.34.167:29626 L=44 S=0x00 I=34067 F=0x0040 T=24
Feb 15 09:48:03 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.168:1564
212.42.34.167:29626 L=44 S=0x00 I=34323 F=0x0040 T=24
Feb 15 09:48:15 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.168:1564
212.42.34.167:29626 L=44 S=0x00 I=43539 F=0x0040 T=24
Feb 15 09:51:11 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.220:1036
212.42.34.167:29626 L=64 S=0x08 I=34560 F=0x0040 T=120
Feb 15 09:51:15 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.220:1036
212.42.34.167:29626 L=64 S=0x08 I=34816 F=0x0040 T=120
Feb 15 09:51:20 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.220:1036
212.42.34.167:29626 L=64 S=0x08 I=35072 F=0x0040 T=120
Feb 15 09:51:33 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.220:1036
212.42.34.167:29626 L=64 S=0x08 I=35584 F=0x0040 T=120
.................................
Feb 15 15:12:10 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.220:1105
212.42.34.167:14578 L=64 S=0x0F I=50437 F=0x0040 T=120
Feb 15 15:12:13 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.220:1105
212.42.34.167:14578 L=64 S=0x0F I=50693 F=0x0040 T=120
Feb 15 15:12:19 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.220:1105
212.42.34.167:14578 L=64 S=0x0F I=51205 F=0x0040 T=120
Feb 15 15:12:31 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.220:1105
212.42.34.167:14578 L=64 S=0x0F I=51717 F=0x0040 T=120
Feb 15 15:14:27 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.168:2132
212.42.34.167:14578 L=44 S=0x00 I=22319 F=0x0040 T=24
Feb 15 15:14:30 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.168:2132
212.42.34.167:14578 L=44 S=0x00 I=25647 F=0x0040 T=24
Feb 15 15:14:36 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.168:2132
212.42.34.167:14578 L=44 S=0x00 I=26927 F=0x0040 T=24
Feb 15 15:14:49 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.168:2132
212.42.34.167:14578 L=44 S=0x00 I=27951 F=0x0040 T=24
Feb 15 15:15:14 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.220:1107
212.42.34.167:14578 L=64 S=0x0A I=56581 F=0x0040 T=120
Feb 15 15:15:17 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.220:1107
212.42.34.167:14578 L=64 S=0x0A I=56837 F=0x0040 T=120
Feb 15 15:15:23 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.220:1107
212.42.34.167:14578 L=64 S=0x0A I=57349 F=0x0040 T=120
Feb 15 15:15:35 inetserver kernel: IP fw-in deny ppp0 TCP 194.87.225.220:1107
212.42.34.167:14578 L=64 S=0x0A I=57605 F=0x0040 T=120
<end of exrpt from syslog>
212.42.34.167 is IP address of Linux Router box. It is given us by our
ISP every time when our modem connects (leased line).
As you can see the port number changes but not too often. May twice a
day.
Can anybody shed some light on this behavior?
Thanks in advance.
Enjoy with LRP
Best regards,
Dmitriy mailto:[EMAIL PROTECTED]
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES
UNSUBSCRIBING!
or email to [EMAIL PROTECTED]
PLEASE read the HOWTO and search the archives before posting.
You can start your search at http://www.indyramp.com/masq/
Please keep general linux/unix/pc/internet questions off the list.
