[Firehol-support] dmesg and logging overflowing

Mark de Ruijter rider at ridersoft.net
Wed Dec 30 12:14:12 GMT 2015


Hi,

I've asked this on numerous places on the web, but couldn't get any 
solid answers. So now I turn to developers and users of Firehol. I've 
used Firehol for many years and was very happy with it. But, ever since 
the update, I can't get rid of the logs;

I've been running a firehol firewall for many years, but since I 
upgraded to Ubuntu 15.10 my dmesg and syslog are filling to the brim 
with these;

[Tue Dec 29 11:52:40 2015] IN-InetZiggo:IN=eth4 OUT= 
MAC=bc:5f:f4:1c:90:b4:00:01:5c:6c:7c:46:08:00 SRC=95.101.203.240 
DST=83.84.30.242 LEN=40 TOS=0x08 PREC=0x40 TTL=60 ID=10038 DF PROTO=TCP 
SPT=80 DPT=57036 WINDOW=0 RES=0x00 RST URGP=0
[Tue Dec 29 11:53:02 2015] IN-InetZiggo:IN=eth4 OUT= 
MAC=bc:5f:f4:1c:90:b4:00:01:5c:6c:7c:46:08:00 SRC=74.125.136.156 
DST=83.84.30.242 LEN=40 TOS=0x08 PREC=0x40 TTL=50 ID=49737 PROTO=TCP 
SPT=443 DPT=49443 WINDOW=0 RES=0x00 RST URGP=0
[Tue Dec 29 11:53:14 2015] IN-InetZiggo:IN=eth4 OUT= 
MAC=bc:5f:f4:1c:90:b4:00:01:5c:6c:7c:46:08:00 SRC=74.125.136.17 
DST=83.84.30.242 LEN=40 TOS=0x08 PREC=0x40 TTL=50 ID=64713 PROTO=TCP 
SPT=443 DPT=54200 WINDOW=0 RES=0x00 RST URGP=0
[Tue Dec 29 11:53:14 2015] IN-InetZiggo:IN=eth4 OUT= 
MAC=bc:5f:f4:1c:90:b4:00:01:5c:6c:7c:46:08:00 SRC=74.125.136.17 
DST=83.84.30.242 LEN=40 TOS=0x08 PREC=0x40 TTL=50 ID=64714 PROTO=TCP 
SPT=443 DPT=54200 WINDOW=0 RES=0x00 RST URGP=0
[Tue Dec 29 11:53:59 2015] IN-InetZiggo:IN=eth4 OUT= 
MAC=bc:5f:f4:1c:90:b4:00:01:5c:6c:7c:46:08:00 SRC=74.125.136.139 
DST=83.84.30.242 LEN=40 TOS=0x08 PREC=0x40 TTL=50 ID=33101 PROTO=TCP 
SPT=443 DPT=49439 WINDOW=0 RES=0x00 RST URGP=0
[Tue Dec 29 11:54:49 2015] IN-InetZiggo:IN=eth4 OUT= 
MAC=bc:5f:f4:1c:90:b4:00:01:5c:6c:7c:46:08:00 SRC=74.125.136.102 
DST=83.84.30.242 LEN=40 TOS=0x08 PREC=0x40 TTL=50 ID=30637 PROTO=TCP 
SPT=443 DPT=49501 WINDOW=0 RES=0x00 RST URGP=0
[Tue Dec 29 11:54:49 2015] IN-InetZiggo:IN=eth4 OUT= 
MAC=bc:5f:f4:1c:90:b4:00:01:5c:6c:7c:46:08:00 SRC=74.125.136.102 
DST=83.84.30.242 LEN=40 TOS=0x08 PREC=0x40 TTL=50 ID=30638 PROTO=TCP 
SPT=443 DPT=49501 WINDOW=0 RES=0x00 RST URGP=0

And I don't know why.
Take for instance this;

PASS-unknown:IN=br0 OUT=eth4 
MAC=00:1b:21:09:ef:5a:64:27:37:19:66:42:08:00 SRC=192.168.40.54 
DST=54.230.13.39 LEN=40 TOS=0x00 PREC=0x00 TTL=127 ID=21253 DF PROTO=TCP 
SPT=49419 DPT=443 WINDOW=0 RES=0x00 ACK RST URGP=0

This seems to be a packet for a HTTPS site at 52.230.13.39, from the 
bridge br0 on the LAN, going via eth4 to the internet. Why would that 
show up in dmesg?

This is the output of iptables for logging

iptables -L | grep LOG
LOG        all  --  anywhere             anywhere limit: avg 1/sec burst 
5 LOG level warning prefix "IN-unknown:"
LOG        all  --  anywhere             anywhere limit: avg 1/sec burst 
5 LOG level warning prefix "PASS-unknown:"
LOG        all  --  anywhere             anywhere limit: avg 1/sec burst 
5 LOG level warning prefix "OUT-unknown:"
LOG        all  --  anywhere             anywhere limit: avg 1/sec burst 
5 LOG level warning prefix "IN-Bridge:"
LOG        all  --  anywhere             anywhere limit: avg 1/sec burst 
5 LOG level warning prefix "IN-InetZiggo:"
LOG        all  --  anywhere             anywhere limit: avg 1/sec burst 
5 LOG level warning prefix "IN-LAN:"
LOG        all  --  anywhere             anywhere limit: avg 1/sec burst 
5 LOG level warning prefix "OUT-Bridge:"
LOG        all  --  anywhere             anywhere limit: avg 1/sec burst 
5 LOG level warning prefix "OUT-InetZiggo:"
LOG        all  --  anywhere             anywhere limit: avg 1/sec burst 
5 LOG level warning prefix "OUT-LAN:"


For reference, this is the firehol.conf

# FireHOL configuration file
#
# See firehol.conf(5) manual page and FireHOL Manual for details.
#
# This configuration file will allow all requests originating from the
# local machine to be send through all network interfaces.
#
# No requests are allowed to come from the network. The host will be
# completely stealthed! It will not respond to anything, and it will
# not be pingable, although it will be able to originate anything
# (even pings to other hosts).
#

version 6

FIREHOL_LOG_MODE = "LOG"
FIREHOL_LOG_LEVEL = "6"

FIREHOL_DROP_ORPHAN_TCP_ACK_FIN=1
FIREHOL_LOG_DROP_INVALID=0

# My SSH thing
server_SSH_ports="tcp/22"
client_SSH_ports="default"

# VPN Server
server_openvpn_ports="tcp/1194"
client_openvpn_ports="default"

# IMAP SSL
server_imapssl_ports="tcp/993"
client_imapssl_ports="default"

# MySQL
server_mysql_ports="tcp/3306"
client_mysql_ports="default"

# Teampspeak
server_teamspeak_ports="udp/8767"
client_teamspeak_ports="default"

# Torrent
server_torrent_ports="udp/51300:51500 tcp/51300:51500"
client_torrent_ports="default"

# voip
server_voip_ports="udp/5060 tcp/5060"
client_voip_ports="default"
server_ts_ports="udp/9987"
client_ts_ports="default"

# block
# block
server_blocker_ports="  tcp/23        udp/23
             tcp/57        udp/67
             tcp/68        udp/68
             tcp/111        udp/111
             tcp/135         udp/135
                         tcp/137         udp/137
                         tcp/138         udp/138
                         tcp/139         udp/139
                         tcp/445         udp/445
                         tcp/1433        udp/1433
                         tcp/1434        udp/1434
                         tcp/2967        udp/2967
                         tcp/5900        udp/5900
                         tcp/6881        udp/6881
                         tcp/3128        udp/3128
                         tcp/59001       udp/59001"
client_blocker_ports="default"

# My Internet Host Ziggo
interface eth4 InetZiggo
     policy drop
     server ident reject with tcp-reset

     # I don't know why this doesn't work
     # client multicast reject with proto-unreach

     server SSH        accept
     server http        accept
     server smtp        accept
     server dns        accept
     server openvpn        accept
     server imapssl        accept
     server torrent        accept
     server icmp        accept
     server blocker        reject

     client all            accept
     server all            reject

# Accept all on the Lan
interface eth0 LAN
     client all    accept
     server all    accept

# Accept all on the Bridge
interface br0 Bridge
     client all    accept
     server all    accept

# LXC Bridge
interface lxcbr0 LXCBridge
     policy accept
     server all        accept
     client all        accept

# LXC Nic
interface veth+ LXCNIC
     policy accept
     server all        accept
     client all        accept

# VPN Tap Device
interface tap0 TapDecvice
     policy accept
     server  all        accept
     client  all        accept

# Allow routing for the lan
router lan2internet inface eth0 outface eth4
     masquerade
     client all      accept
     server all     accept

# Allow routing for the Bridge
router br2internet inface br0 outface eth4
     masquerade
     client all      accept
     server all      accept

# Allow routing for Bridge To Bridge
router br2br inface br0 outface br0
     policy accept

# Allow all routing for inface lxcbr0
router lx2veth inface lxcbr0 outface veth+
     masquerade
     server all     accept
     client all    accept

router veth2lx inface veth+ outface lxcbr0
     masquerade
     client all    accept
     server all    accept



More information about the Firehol-support mailing list