Tonight I got the same "anywhere to anywhere" rule but found my server
offline, this morning. DAMMED! A few hours offline!
And there's again nothing suspect in the default logs.
To figure out, what exactly happens I did some little changes into
firewall-drop.sh, this morning:
First of all, I've added a ristriction to eth0. If I get a total block
on eth1, I'm in real trouble! ... more as I am already, when all the
VServers are down.
Propably, the question for a specific device could be an Installation-
Option?
> if [ "X${UNAME}" = "XLinux" ]; then
> if [ "x${ACTION}" = "xadd" ]; then
> ARG1="-I INPUT -i eth0 -s ${IP} -j DROP"
> ARG2="-I FORWARD -i eth0 -s ${IP} -j DROP"
> else
> ARG1="-D INPUT -i eth0 -s ${IP} -j DROP"
> ARG2="-D FORWARD -i eth0 -s ${IP} -j DROP"
> fi
directly after this, I added my custom Log in this way:
echo "`date`: ARG1: $ARG1, ARG2: $ARG2" >> /var/ossec/logs/ossec-
custlog.log
within the executing and exiting section I added this two lines
directly after the executing lines:
> echo "`date` $IPTABLES $ARG1" >> /var/ossec/logs/ossec-execlog.log
and
> echo "`date` $IPTABLES $ARG2" >> /var/ossec/logs/ossec-execlog.log
I hope, I'll find the Problem in this way,
Have a nice Sunday,
Oskar
