Don't know what I am missing but running scans of a 3.4 stable box (updated
12/21) shows udp port 514 open. I block by default, added these two rules to
see if I could make it go away. Pretty standard box with 1 internet
connection, a DMZ and a lan interface. The Internet interface has ip aliases
on it for a few IP addresses, removed these as well since it shows on scans of
the aliased IP's as well.
block in log quick on $all_ints proto { udp, tcp } from any to any port 514
block in log quick on fxp2 proto udp from any to any port 514
First rule shows it blocking a packet on fxp2, but tcpdump shows it coming
through, so added second rule and it isn't catching anything after the first
one thinks it gets blocked.
RULE ACTION DIR LOG Q IF PR K PKTS BYTES STATES MAX INFO
4 Block In Log Q fxp2 udp 2 56 0 drop from
any to any port = 514
12 Block In Log Q fxp2 udp 0 0 0 drop from
any to any port = 514
vulcan# tcpdump -i fxp2 port 514
tcpdump: listening on fxp2
22:57:52.885387 1.6.0.90.34878 > 1.3.0.81.514: udp 0
22:58:35.078369 1.6.0.90.34663 > 1.3.0.89.514: udp 0
22:58:41.085093 1.6.0.90.34664 > 1.3.0.89.514: udp 0
ran scans with nessus and nmap, both show udp port 514 open. Turned off Nat's
and redirects, this did not change anything though. Tried a block all quick on
internet interface, it still shows it open. Does this make sense to anyone?
IP address changed let me know if you need to see the whole ruleset.
Thanks
Greg McConkey
-------------------------------------------------
TBC Net, Inc. Webmail http://www.tbc.net
