Hi Oskar,
did it happen again? Did the log tell you something?
Andre Pawlowski
-------------------------------------------------------------------
Poor is the pupil who does not surpass his master.
-Leonardo da Vinci
On 08/22/2010 09:10 AM, WebWusel wrote:
> Tonight I got the same "anywhere to anywhere" rule but found my server
> offline, this morning. DAMMED! A few hours offline!
>
> And there's again nothing suspect in the default logs.
>
> To figure out, what exactly happens I did some little changes into
> firewall-drop.sh, this morning:
>
> First of all, I've added a ristriction to eth0. If I get a total block
> on eth1, I'm in real trouble! ... more as I am already, when all the
> VServers are down.
>
> Propably, the question for a specific device could be an Installation-
> Option?
>
>> if [ "X${UNAME}" = "XLinux" ]; then
>> if [ "x${ACTION}" = "xadd" ]; then
>> ARG1="-I INPUT -i eth0 -s ${IP} -j DROP"
>> ARG2="-I FORWARD -i eth0 -s ${IP} -j DROP"
>> else
>> ARG1="-D INPUT -i eth0 -s ${IP} -j DROP"
>> ARG2="-D FORWARD -i eth0 -s ${IP} -j DROP"
>> fi
>
> directly after this, I added my custom Log in this way:
>
> echo "`date`: ARG1: $ARG1, ARG2: $ARG2" >> /var/ossec/logs/ossec-
> custlog.log
>
> within the executing and exiting section I added this two lines
> directly after the executing lines:
>
>> echo "`date` $IPTABLES $ARG1" >> /var/ossec/logs/ossec-execlog.log
> and
>> echo "`date` $IPTABLES $ARG2" >> /var/ossec/logs/ossec-execlog.log
>
> I hope, I'll find the Problem in this way,
>
> Have a nice Sunday,
>
> Oskar
