On 30.01.2012 22:55, Tom Eastep wrote: > On Jan 30, 2012, at 1:29 PM, Michael Kress wrote: > >> >> But I have one rule that doesn't block requests: >> 58.208.0.0/12 >> >> I have for sure restarted shorewall (using Shorewall-4.4.11.2), but I >> still get port scans and http requests from >> 58.218.199.227 > > Where are you seeing those requests? Can you show us an example? > >
found it e.g. in access_log of apache httpd which also has been restarted: 58.218.199.227 - - [30/Jan/2012:10:17:03 +0100] "GET http://www.hardjob.net/proxyheader.php HTTP/1.1" 404 293 58.218.199.227 - - [30/Jan/2012:12:13:49 +0100] "GET http://www.mr179.com/proxyheader.php HTTP/1.1" 404 291 58.218.199.227 - - [30/Jan/2012:18:06:00 +0100] "GET http://www.sharkspear.info/proxyheader.php HTTP/1.1" 404 297 58.218.199.227 - - [30/Jan/2012:20:05:34 +0100] "GET http://cobebizs.com/proxyheader.php HTTP/1.1" 404 290 58.218.199.250 - - [30/Jan/2012:21:17:43 +0100] "GET http://cobebizs.com/proxyheader.php HTTP/1.1" 404 290 58.218.199.227 - - [30/Jan/2012:22:02:42 +0100] "GET http://cobebizs.com/proxyheader.php HTTP/1.1" 404 290 I'm trying now to put in 58.218.199.227/32 58.218.199.250/32 as a remedy - we'll see. Regards Michael ------------------------------------------------------------------------------ Keep Your Developer Skills Current with LearnDevNow! The most comprehensive online learning library for Microsoft developers is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3, Metro Style Apps, more. Free future releases when you subscribe now! http://p.sf.net/sfu/learndevnow-d2d _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
