On Tue, Dec 30, 2003 at 11:43:19PM -0600, [EMAIL PROTECTED] wrote:
> Don't know what I am missing but running scans of a 3.4 stable box (updated
> 12/21) shows udp port 514 open.
syslogd listens keeps udp port 514 open to prevent other programs from
binding. It would not process received packets by default.
> I block by default, added these two rules to
> see if I could make it go away. Pretty standard box with 1 internet
> connection, a DMZ and a lan interface. The Internet interface has ip aliases
> on it for a few IP addresses, removed these as well since it shows on scans of
> the aliased IP's as well.
>
> block in log quick on $all_ints proto { udp, tcp } from any to any port 514
> block in log quick on fxp2 proto udp from any to any port 514
>
> First rule shows it blocking a packet on fxp2, but tcpdump shows it coming
> through, so added second rule and it isn't catching anything after the first
> one thinks it gets blocked.
>
> RULE ACTION DIR LOG Q IF PR K PKTS BYTES STATES MAX INFO
> 4 Block In Log Q fxp2 udp 2 56 0 drop from
> any to any port = 514
> 12 Block In Log Q fxp2 udp 0 0 0 drop from
> any to any port = 514
so, your packets are being blocked, that is nice :)
> vulcan# tcpdump -i fxp2 port 514
> tcpdump: listening on fxp2
> 22:57:52.885387 1.6.0.90.34878 > 1.3.0.81.514: udp 0
> 22:58:35.078369 1.6.0.90.34663 > 1.3.0.89.514: udp 0
> 22:58:41.085093 1.6.0.90.34664 > 1.3.0.89.514: udp 0
tcpdump looks at the interface _before_ pf, so you are seeing packets
before they are blocked. This is normal too.
> ran scans with nessus and nmap, both show udp port 514 open. Turned off Nat's
> and redirects, this did not change anything though. Tried a block all quick on
> internet interface, it still shows it open. Does this make sense to anyone?
> IP address changed let me know if you need to see the whole ruleset.
Ah, how do you define 'open' for udp?
since udp is a connectionless protocol, the scanners _assume_ that it is
open if they do not receive an icmp port-unreachable packet. Your rules
just drop the packet, and do not return anything.
Try 'block return' in your rules
Can
