Re: [nlug] weird entry in Logwatch daily emails - source IP address of sshd session is wrong?

2014-08-07 Thread Chris McQuistion
Interesting thought. The firewall rules are the same for this server as all the other servers and none of the other servers are showing this anomaly in their logs. I went ahead and deleted the rule, then recreated it, then tested again. Same results. The day that I started getting these weird

Re: [nlug] weird entry in Logwatch daily emails - source IP address of sshd session is wrong?

2014-08-07 Thread Sabuj Pattanayek
the interesting part is that it only seems to be happening on his RHEL5 system and not on the other ones. On Thu, Aug 7, 2014 at 11:48 AM, Tilghman Lesher tilgh...@meg.abyt.es wrote: None of those packages would affect how packets are logged. At this point, I'd do a tcpdump on the external

Re: [nlug] weird entry in Logwatch daily emails - source IP address of sshd session is wrong?

2014-08-07 Thread Chris McQuistion
Mystery solved! I called Untangle and got some help from them. (I'm paying for this thing, so I ought to get some tech support, right?) My port forwarding and everything was pretty straightforward and nothing wrong there. Untangle has the ability to create static routes, but they also have NAT

Re: [nlug] weird entry in Logwatch daily emails - source IP address of sshd session is wrong?

2014-08-07 Thread Paul Boniol
I'm assuming you can interactively log in from home (or other off site networks). The first thing I would do after logging in is: netstat -tunap Look for an established connection on port 22. It will tell you what it sees as your IP address. If it sees 192.168.1.254, then it is a firewall

Re: [nlug] weird entry in Logwatch daily emails - source IP address of sshd session is wrong?

2014-08-07 Thread Chris McQuistion
We're doing NAT. We just don't need additional NAT rules according to the Untangle definition of them. We should have just been using the system-created rules and not creating additional rules of our own. On Thu, Aug 7, 2014 at 3:01 PM, Paul Boniol paul.bon...@gmail.com wrote: Something will