thr3ads.net - Shorewall users - [Shorewall-users] Bizzare Networking problem [Mar 2003]

If this information is useful, please help other people find it:
Share via:

Aaron Held

2003-Mar-18 14:37 UTC

[Shorewall-users] Bizzare Networking problem

I just put up a Gentoo based shorewall firewall in a pretty standard 
three interface setup.

Everything worked great in the test environment, and it mostly works live.
There are three pc''s on the local side that cannot access one machine
in
the DMZ.

Everybody can ping, they just cannot open a tcp socket to one webserver 
in the DMZ.  They can talk to the email server sitting right next to it 
though.

DMZ = 10.1.64.xx
Loc = 10.1.32.xx

I am at a loss about what to try next, any advice will be much appreciated.

linuxfirewall(266) conf # shorewall version
1.3.9b
linuxfirewall(266) conf # uname -a
Linux linuxfirewall.nameconnector.com 2.4.19-gentoo-r9 #5 SMP Mon Nov 18 
07:40:02 EST 2002 i686 GenuineIntel
linuxfirewall(266) root # ip route show
66.9.109.128/25 dev eth0  proto kernel  scope link  src 66.9.109.130
10.1.32.0/24 dev eth1  proto kernel  scope link  src 10.1.32.1
10.1.64.0/24 dev eth2  proto kernel  scope link  src 10.1.64.1
66.0.0.0/8 dev eth0  proto kernel  scope link  src 66.9.109.133
default via 66.9.109.129 dev eth0  metric 1

Thanks,
-Aaron Held

Tom Eastep

2003-Mar-18 14:40 UTC

head link

[Shorewall-users] Bizzare Networking problem

On Tue, 18 Mar 2003, Aaron Held wrote:
> 
> Everybody can ping, they just cannot open a tcp socket to one webserver 
> in the DMZ.  They can talk to the email server sitting right next to it 
> though.
> 
Please post the output of "shorewall status" as an attachment as
described
at http://www.shorewall.net/support.htm.

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
Shoreline,     \ http://shorewall.sf.net
Washington USA  \ teastep@shorewall.net

Aaron Held

2003-Mar-18 18:31 UTC

head link

[Shorewall-users] Bizzare Networking problem

I thought maybe someone had some suggestions as to where to look, but 
here is the status dump.

Thanks for your help

-Aaron Held

Tom Eastep wrote:
>On Tue, 18 Mar 2003, Aaron Held wrote:
>
>  
>
>>Everybody can ping, they just cannot open a tcp socket to one webserver 
>>in the DMZ.  They can talk to the email server sitting right next to it 
>>though.
>>
>>    
>>
>
>Please post the output of "shorewall status" as an attachment as
described
>at http://www.shorewall.net/support.htm.
>
>-Tom
>  
>
-------------- next part --------------
=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2003.03.18 21:25:00
=~=~=~=~=~=~=~=~=~=~=~shorewall status
Shorewall-1.3.9b Status at linuxfirewall.nameconnector.com - Tue Mar 18 21:13:08
EST 2003

Counters reset Tue Mar 18 17:19:34 EST 2003

Chain INPUT (policy DROP 51 packets, 3990 bytes)
 pkts bytes target     prot opt in     out     source               destination
    5   560 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
 4068  314K eth0_in    all  --  eth0   *       0.0.0.0/0            0.0.0.0/0
30224 3043K eth1_in    all  --  eth1   *       0.0.0.0/0            0.0.0.0/0
   90 15334 eth2_in    all  --  eth2   *       0.0.0.0/0            0.0.0.0/0
 1039 94802 ppp_in     all  --  ppp+   *       0.0.0.0/0            0.0.0.0/0
    0     0 common     all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0   
LOG flags 0 level 6 prefix `Shorewall:INPUT:REJECT:''
    0     0 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP 49 packets, 5816 bytes)
 pkts bytes target     prot opt in     out     source               destination
97546   23M eth0_fwd   all  --  eth0   *       0.0.0.0/0            0.0.0.0/0
 306K   95M eth1_fwd   all  --  eth1   *       0.0.0.0/0            0.0.0.0/0
 181K   40M eth2_fwd   all  --  eth2   *       0.0.0.0/0            0.0.0.0/0
    8   732 ppp_fwd    all  --  ppp+   *       0.0.0.0/0            0.0.0.0/0
    0     0 common     all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0   
LOG flags 0 level 6 prefix `Shorewall:FORWARD:REJECT:''
    0     0 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    5   560 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0
  475 43493 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW,RELATED,ESTABLISHED
 2590  222K fw2net     all  --  *      eth0    0.0.0.0/0            0.0.0.0/0
  372 32362 fw2loc     all  --  *      eth1    0.0.0.0/0            10.1.32.0/24
  450  131K fw2loc     all  --  *      ppp+    0.0.0.0/0            10.1.32.0/24
    0     0 fw2loc     all  --  *      eth1    0.0.0.0/0            0.0.0.0/0
    0     0 fw2dmz     all  --  *      eth2    0.0.0.0/0            0.0.0.0/0
    0     0 common     all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0   
LOG flags 0 level 6 prefix `Shorewall:OUTPUT:REJECT:''
    0     0 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain all2all (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0   
state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW tcp flags:!0x16/0x02
    0     0 common     all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0   
LOG flags 0 level 6 prefix `Shorewall:all2all:REJECT:''
    0     0 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain common (5 references)
 pkts bytes target     prot opt in     out     source               destination
  241 15944 icmpdef    icmp --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state INVALID
   54  4870 REJECT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0   
udp dpts:137:139 reject-with icmp-port-unreachable
    0     0 REJECT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0   
udp dpt:445 reject-with icmp-port-unreachable
   15   780 reject     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
tcp dpt:135
    0     0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0   
udp dpt:1900
    0     0 DROP       all  --  *      *       0.0.0.0/0           
255.255.255.255
    0     0 DROP       all  --  *      *       0.0.0.0/0            224.0.0.0/4
    1    60 reject     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
tcp dpt:113
    5   335 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0   
udp spt:53 state NEW
    0     0 DROP       all  --  *      *       0.0.0.0/0            66.9.109.255
    0     0 DROP       all  --  *      *       0.0.0.0/0            10.1.32.255
    0     0 DROP       all  --  *      *       0.0.0.0/0            10.1.64.255

Chain dmz2fw (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0   
state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW tcp flags:!0x16/0x02
   90 15334 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain dmz2loc (3 references)
 pkts bytes target     prot opt in     out     source               destination
 173K   37M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0   
state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW tcp flags:!0x16/0x02
   57  7068 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0   
icmp type 8
  675  160K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain dmz2net (1 references)
 pkts bytes target     prot opt in     out     source               destination
 7077 2736K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0   
state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW tcp flags:!0x16/0x02
  250 12000 ACCEPT     tcp  --  *      *       10.1.64.3            0.0.0.0/0   
state NEW tcp dpt:25
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0           
208.240.241.216    state NEW tcp dpt:80
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0           
208.240.241.216    state NEW tcp dpt:443
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0   
icmp type 8
   78 56148 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain dynamic (8 references)
 pkts bytes target     prot opt in     out     source               destination

Chain eth0_fwd (1 references)
 pkts bytes target     prot opt in     out     source               destination
97546   23M dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0
97546   23M rfc1918    all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 net2net    all  --  *      eth0    0.0.0.0/0            0.0.0.0/0
88845   21M net2loc    all  --  *      eth1    0.0.0.0/0            10.1.32.0/24
    0     0 net2loc    all  --  *      ppp+    0.0.0.0/0            10.1.32.0/24
    0     0 net2loc    all  --  *      eth1    0.0.0.0/0            0.0.0.0/0
 8686 2659K net2dmz    all  --  *      eth2    0.0.0.0/0            0.0.0.0/0

Chain eth0_in (1 references)
 pkts bytes target     prot opt in     out     source               destination
 4068  314K dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0
 4068  314K rfc1918    all  --  *      *       0.0.0.0/0            0.0.0.0/0
  388 30945 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0   
icmp type 8
 3677  282K net2fw     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain eth1_fwd (1 references)
 pkts bytes target     prot opt in     out     source               destination
 306K   95M dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0
 128K   60M loc2net    all  --  *      eth0    10.1.32.0/24         0.0.0.0/0
 5243  487K loc2net    all  --  *      eth0    0.0.0.0/0            0.0.0.0/0
    0     0 loc2loc    all  --  *      eth1    10.1.32.0/24         10.1.32.0/24
    8   708 loc2loc    all  --  *      ppp+    10.1.32.0/24         10.1.32.0/24
    0     0 loc2loc    all  --  *      eth1    10.1.32.0/24         0.0.0.0/0
    0     0 loc2loc    all  --  *      eth1    0.0.0.0/0            10.1.32.0/24
    0     0 loc2loc    all  --  *      ppp+    0.0.0.0/0            10.1.32.0/24
   12  1152 loc2loc    all  --  *      eth1    0.0.0.0/0            0.0.0.0/0
 172K   34M loc2dmz    all  --  *      eth2    10.1.32.0/24         0.0.0.0/0
    0     0 loc2dmz    all  --  *      eth2    0.0.0.0/0            0.0.0.0/0

Chain eth1_in (1 references)
 pkts bytes target     prot opt in     out     source               destination
30224 3043K dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0   
icmp type 8
30224 3043K loc2fw     all  --  *      *       10.1.32.0/24         0.0.0.0/0
    0     0 loc2fw     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain eth2_fwd (1 references)
 pkts bytes target     prot opt in     out     source               destination
 181K   40M dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0
 7405 2804K dmz2net    all  --  *      eth0    0.0.0.0/0            0.0.0.0/0
 174K   37M dmz2loc    all  --  *      eth1    0.0.0.0/0            10.1.32.0/24
    0     0 dmz2loc    all  --  *      ppp+    0.0.0.0/0            10.1.32.0/24
    0     0 dmz2loc    all  --  *      eth1    0.0.0.0/0            0.0.0.0/0

Chain eth2_in (1 references)
 pkts bytes target     prot opt in     out     source               destination
   90 15334 dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0   
icmp type 8
   90 15334 dmz2fw     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain fw2dmz (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0   
state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW tcp flags:!0x16/0x02
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW tcp dpt:25
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain fw2loc (3 references)
 pkts bytes target     prot opt in     out     source               destination
  822  163K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0   
state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW tcp flags:!0x16/0x02
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain fw2net (1 references)
 pkts bytes target     prot opt in     out     source               destination
 2585  222K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0   
state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW tcp flags:!0x16/0x02
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            160.79.6.130
state NEW tcp dpt:53
    2   139 ACCEPT     udp  --  *      *       0.0.0.0/0            160.79.6.130
state NEW udp dpt:53
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            160.79.5.130
state NEW tcp dpt:53
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            160.79.5.130
state NEW udp dpt:53
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW tcp dpt:22
    3   170 ACCEPT     47   --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 all2all    all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain icmpdef (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0   
icmp type 8

Chain loc2dmz (3 references)
 pkts bytes target     prot opt in     out     source               destination
 171K   34M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0   
state RELATED,ESTABLISHED
    1    40 newnotsyn  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW tcp flags:!0x16/0x02
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW tcp dpt:22
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0   
icmp type 8
 1022 46148 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain loc2fw (3 references)
 pkts bytes target     prot opt in     out     source               destination
 1327  120K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0   
state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW tcp flags:!0x16/0x02
    2    96 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW tcp dpt:22
29934 3018K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain loc2loc (9 references)
 pkts bytes target     prot opt in     out     source               destination
   15  1344 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0   
state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW tcp flags:!0x16/0x02
   13  1248 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain loc2net (3 references)
 pkts bytes target     prot opt in     out     source               destination
87710   57M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0   
state RELATED,ESTABLISHED
  119 51360 newnotsyn  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW tcp flags:!0x16/0x02
45381 2861K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain logdrop (27 references)
 pkts bytes target     prot opt in     out     source               destination
   18   990 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0   
LOG flags 0 level 6 prefix `Shorewall:rfc1918:DROP:''
   18   990 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain net2all (4 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0   
state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW tcp flags:!0x16/0x02
 2042 95865 common     all  --  *      *       0.0.0.0/0            0.0.0.0/0
 1967 89820 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0   
LOG flags 0 level 6 prefix `Shorewall:net2all:DROP:''
 1967 89820 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain net2dmz (1 references)
 pkts bytes target     prot opt in     out     source               destination
 8088 2631K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0   
state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW tcp flags:!0x16/0x02
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0   
icmp type 8
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            10.1.64.3   
state NEW tcp dpt:143
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            10.1.64.3   
state NEW tcp dpt:110
    3   168 ACCEPT     tcp  --  *      *       0.0.0.0/0            10.1.64.3   
state NEW tcp dpt:21
  149  8068 ACCEPT     tcp  --  *      *       0.0.0.0/0            10.1.64.3   
state NEW tcp dpt:25
   39  1944 ACCEPT     tcp  --  *      *       0.0.0.0/0            10.1.64.2   
state NEW tcp dpt:80
  407 18612 ACCEPT     tcp  --  *      *       0.0.0.0/0            10.1.64.2   
state NEW tcp dpt:443
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            10.1.64.2   
state NEW tcp dpt:80
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            10.1.64.2   
state NEW tcp dpt:443
    0     0 net2all    all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain net2fw (1 references)
 pkts bytes target     prot opt in     out     source               destination
 1304  148K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0   
state RELATED,ESTABLISHED
  327 38277 newnotsyn  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW tcp flags:!0x16/0x02
    4   196 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW tcp dpt:1723
    0     0 ACCEPT     47   --  *      *       0.0.0.0/0            0.0.0.0/0
 2042 95865 net2all    all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain net2loc (3 references)
 pkts bytes target     prot opt in     out     source               destination
88845   21M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0   
state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW tcp flags:!0x16/0x02
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0   
icmp type 8
    0     0 net2all    all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain net2net (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0   
state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW tcp flags:!0x16/0x02
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0   
icmp type 8
    0     0 net2all    all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain newnotsyn (16 references)
 pkts bytes target     prot opt in     out     source               destination
  447 89677 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0   
LOG flags 0 level 6 prefix `Shorewall:newnotsyn:DROP:''
  447 89677 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ppp_fwd (1 references)
 pkts bytes target     prot opt in     out     source               destination
    8   732 dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 loc2net    all  --  *      eth0    10.1.32.0/24         0.0.0.0/0
    8   732 loc2loc    all  --  *      eth1    10.1.32.0/24         10.1.32.0/24
    0     0 loc2loc    all  --  *      ppp+    10.1.32.0/24         10.1.32.0/24
    0     0 loc2loc    all  --  *      eth1    10.1.32.0/24         0.0.0.0/0
    0     0 loc2dmz    all  --  *      eth2    10.1.32.0/24         0.0.0.0/0

Chain ppp_in (1 references)
 pkts bytes target     prot opt in     out     source               destination
 1039 94802 dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0   
icmp type 8
 1039 94802 loc2fw     all  --  *      *       10.1.32.0/24         0.0.0.0/0

Chain reject (6 references)
 pkts bytes target     prot opt in     out     source               destination
   16   840 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
reject-with tcp-reset
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0   
reject-with icmp-port-unreachable

Chain rfc1918 (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 RETURN     all  --  *      *       255.255.255.255      0.0.0.0/0
    0     0 DROP       all  --  *      *       169.254.0.0/16       0.0.0.0/0
    0     0 logdrop    all  --  *      *       172.16.0.0/12        0.0.0.0/0
    0     0 logdrop    all  --  *      *       192.0.2.0/24         0.0.0.0/0
    7   442 logdrop    all  --  *      *       192.168.0.0/16       0.0.0.0/0
    0     0 logdrop    all  --  *      *       0.0.0.0/7            0.0.0.0/0
    0     0 logdrop    all  --  *      *       2.0.0.0/8            0.0.0.0/0
    0     0 logdrop    all  --  *      *       5.0.0.0/8            0.0.0.0/0
    0     0 logdrop    all  --  *      *       7.0.0.0/8            0.0.0.0/0
    6   336 logdrop    all  --  *      *       10.0.0.0/8           0.0.0.0/0
    0     0 logdrop    all  --  *      *       23.0.0.0/8           0.0.0.0/0
    0     0 logdrop    all  --  *      *       27.0.0.0/8           0.0.0.0/0
    0     0 logdrop    all  --  *      *       31.0.0.0/8           0.0.0.0/0
    0     0 logdrop    all  --  *      *       36.0.0.0/7           0.0.0.0/0
    0     0 logdrop    all  --  *      *       39.0.0.0/8           0.0.0.0/0
    0     0 logdrop    all  --  *      *       41.0.0.0/8           0.0.0.0/0
    0     0 logdrop    all  --  *      *       42.0.0.0/8           0.0.0.0/0
    0     0 logdrop    all  --  *      *       58.0.0.0/7           0.0.0.0/0
    0     0 logdrop    all  --  *      *       60.0.0.0/8           0.0.0.0/0
    0     0 logdrop    all  --  *      *       70.0.0.0/7           0.0.0.0/0
    0     0 logdrop    all  --  *      *       72.0.0.0/5           0.0.0.0/0
    5   212 logdrop    all  --  *      *       82.0.0.0/7           0.0.0.0/0
    0     0 logdrop    all  --  *      *       84.0.0.0/6           0.0.0.0/0
    0     0 logdrop    all  --  *      *       88.0.0.0/5           0.0.0.0/0
    0     0 logdrop    all  --  *      *       96.0.0.0/3           0.0.0.0/0
    0     0 logdrop    all  --  *      *       127.0.0.0/8          0.0.0.0/0
    0     0 logdrop    all  --  *      *       197.0.0.0/8          0.0.0.0/0
    0     0 logdrop    all  --  *      *       222.0.0.0/7          0.0.0.0/0
    0     0 logdrop    all  --  *      *       240.0.0.0/4          0.0.0.0/0

Chain shorewall (0 references)
 pkts bytes target     prot opt in     out     source               destination

Mar 18 21:11:11 [kernel] Shorewall:newnotsyn:DROP:IN=eth1 OUT=eth0
SRC=10.1.32.139 DST=207.159.131.106 LEN=63 TOS=0x00 PREC=0x00 TTL=127 ID=55269
DF PROTO=TCP SPT=1809 DPT=143 WINDOW=62823 RES=0x00 ACK PSH FIN URGP=0
Mar 18 21:11:12 [kernel] Shorewall:newnotsyn:DROP:IN=eth1 OUT=eth0
SRC=10.1.32.139 DST=207.159.131.106 LEN=63 TOS=0x00 PREC=0x00 TTL=127 ID=55284
DF PROTO=TCP SPT=1809 DPT=143 WINDOW=62823 RES=0x00 ACK PSH FIN URGP=0
Mar 18 21:11:15 [kernel] Shorewall:newnotsyn:DROP:IN=eth1 OUT=eth0
SRC=10.1.32.139 DST=207.159.131.106 LEN=63 TOS=0x00 PREC=0x00 TTL=127 ID=55286
DF PROTO=TCP SPT=1809 DPT=143 WINDOW=62823 RES=0x00 ACK PSH FIN URGP=0
Mar 18 21:11:17 [kernel] Shorewall:net2all:DROP:IN=eth0 OUT= SRC=65.165.207.28
DST=66.9.109.133 LEN=40 TOS=0x00 PREC=0x00 TTL=115 ID=60403 PROTO=UDP SPT=14461
DPT=0 LEN=20
Mar 18 21:11:19 [kernel] Shorewall:newnotsyn:DROP:IN=eth1 OUT=eth0
SRC=10.1.32.139 DST=207.159.131.106 LEN=63 TOS=0x00 PREC=0x00 TTL=127 ID=55288
DF PROTO=TCP SPT=1809 DPT=143 WINDOW=62823 RES=0x00 ACK PSH FIN URGP=0
Mar 18 21:11:24 [kernel] Shorewall:net2all:DROP:IN=eth0 OUT= SRC=152.19.187.176
DST=66.9.109.133 LEN=40 TOS=0x00 PREC=0x00 TTL=116 ID=46915 PROTO=UDP SPT=6346
DPT=0 LEN=20
Mar 18 21:11:25 [kernel] Shorewall:net2all:DROP:IN=eth0 OUT= SRC=212.64.25.43
DST=66.9.109.133 LEN=40 TOS=0x00 PREC=0x00 TTL=112 ID=52312 PROTO=UDP SPT=14940
DPT=0 LEN=20
Mar 18 21:11:33 [kernel] Shorewall:net2all:DROP:IN=eth0 OUT= SRC=212.64.25.43
DST=66.9.109.133 LEN=40 TOS=0x00 PREC=0x00 TTL=112 ID=53478 PROTO=UDP SPT=14940
DPT=0 LEN=20
Mar 18 21:11:39 [kernel] Shorewall:net2all:DROP:IN=eth0 OUT= SRC=212.64.25.43
DST=66.9.109.133 LEN=40 TOS=0x00 PREC=0x00 TTL=112 ID=54353 PROTO=UDP SPT=14940
DPT=0 LEN=20
Mar 18 21:11:58 [kernel] Shorewall:newnotsyn:DROP:IN=eth0 OUT=
SRC=138.237.180.106 DST=66.9.109.133 LEN=40 TOS=0x00 PREC=0x00 TTL=95 ID=62009
DF PROTO=TCP SPT=6347 DPT=2626 WINDOW=0 RES=0x00 RST URGP=0
Mar 18 21:11:59 [kernel] Shorewall:newnotsyn:DROP:IN=eth0 OUT=
SRC=138.237.180.106 DST=66.9.109.133 LEN=40 TOS=0x00 PREC=0x00 TTL=95 ID=63033
DF PROTO=TCP SPT=6347 DPT=2626 WINDOW=0 RES=0x00 RST URGP=0
Mar 18 21:11:59 [kernel] Shorewall:newnotsyn:DROP:IN=eth0 OUT=
SRC=138.237.180.106 DST=66.9.109.133 LEN=40 TOS=0x00 PREC=0x00 TTL=95 ID=63545
DF PROTO=TCP SPT=6347 DPT=2626 WINDOW=0 RES=0x00 RST URGP=0
Mar 18 21:12:00 [kernel] Shorewall:newnotsyn:DROP:IN=eth0 OUT=
SRC=138.237.180.106 DST=66.9.109.133 LEN=40 TOS=0x00 PREC=0x00 TTL=95 ID=64825
DF PROTO=TCP SPT=6347 DPT=2626 WINDOW=0 RES=0x00 RST URGP=0
Mar 18 21:12:06 [kernel] Shorewall:net2all:DROP:IN=eth0 OUT= SRC=212.64.25.43
DST=66.9.109.133 LEN=40 TOS=0x00 PREC=0x00 TTL=109 ID=57694 PROTO=UDP SPT=14940
DPT=0 LEN=20
Mar 18 21:12:13 [kernel] Shorewall:net2all:DROP:IN=eth0 OUT= SRC=212.64.25.43
DST=66.9.109.133 LEN=40 TOS=0x00 PREC=0x00 TTL=109 ID=58823 PROTO=UDP SPT=14940
DPT=0 LEN=20
Mar 18 21:12:17 [kernel] Shorewall:net2all:DROP:IN=eth0 OUT= SRC=65.165.207.28
DST=66.9.109.133 LEN=40 TOS=0x00 PREC=0x00 TTL=115 ID=5384 PROTO=UDP SPT=14461
DPT=0 LEN=20
Mar 18 21:12:19 [kernel] Shorewall:net2all:DROP:IN=eth0 OUT= SRC=212.64.25.43
DST=66.9.109.133 LEN=40 TOS=0x00 PREC=0x00 TTL=109 ID=59688 PROTO=UDP SPT=14940
DPT=0 LEN=20
Mar 18 21:12:36 [kernel] Shorewall:net2all:DROP:IN=eth0 OUT= SRC=65.165.207.28
DST=66.9.109.133 LEN=40 TOS=0x00 PREC=0x00 TTL=115 ID=8945 PROTO=UDP SPT=14461
DPT=0 LEN=20
Mar 18 21:12:41 [kernel] Shorewall:newnotsyn:DROP:IN=eth1 OUT=eth0
SRC=10.1.32.45 DST=209.61.186.253 LEN=40 TOS=0x00 PREC=0x00 TTL=127 ID=60474 DF
PROTO=TCP SPT=2594 DPT=80 WINDOW=0 RES=0x00 RST URGP=0
Mar 18 21:13:06 [kernel] Shorewall:net2all:DROP:IN=eth0 OUT= SRC=212.64.25.43
DST=66.9.109.133 LEN=40 TOS=0x00 PREC=0x00 TTL=109 ID=29 PROTO=UDP SPT=14940
DPT=0 LEN=20

Chain PREROUTING (policy ACCEPT 496K packets, 44M bytes)
 pkts bytes target     prot opt in     out     source               destination
 3117  178K net_dnat   all  --  eth0   *       0.0.0.0/0            0.0.0.0/0

Chain POSTROUTING (policy ACCEPT 65977 packets, 4497K bytes)
 pkts bytes target     prot opt in     out     source               destination
16050  856K eth0_masq  all  --  *      eth0    0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 269 packets, 19608 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain eth0_masq (1 references)
 pkts bytes target     prot opt in     out     source               destination
15801  833K SNAT       all  --  *      *       10.1.32.0/24         0.0.0.0/0   
to:66.9.109.133
  180 17560 SNAT       all  --  *      *       10.1.64.0/24         0.0.0.0/0   
to:66.9.109.141

Chain net_dnat (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            66.9.109.141
tcp dpt:143 to:10.1.64.3
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            66.9.109.141
tcp dpt:110 to:10.1.64.3
    3   168 DNAT       tcp  --  *      *       0.0.0.0/0            66.9.109.141
tcp dpt:21 to:10.1.64.3
  150  8108 DNAT       tcp  --  *      *       0.0.0.0/0            66.9.109.141
tcp dpt:25 to:10.1.64.3
    4   216 DNAT       tcp  --  *      *       0.0.0.0/0            66.9.109.130
tcp dpt:80 to:10.1.64.2
   22  1320 DNAT       tcp  --  *      *       0.0.0.0/0            66.9.109.130
tcp dpt:443 to:10.1.64.2
   27  1320 DNAT       tcp  --  *      *       0.0.0.0/0            66.9.109.150
tcp dpt:80 to:10.1.64.2
  385 17292 DNAT       tcp  --  *      *       0.0.0.0/0            66.9.109.150
tcp dpt:443 to:10.1.64.2

Chain PREROUTING (policy ACCEPT 9479K packets, 3350M bytes)
 pkts bytes target     prot opt in     out     source               destination
 442K  254M man1918    all  --  eth0   *       0.0.0.0/0            0.0.0.0/0
1688K  558M pretos     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain INPUT (policy ACCEPT 928K packets, 108M bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 8540K packets, 3241M bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 523K packets, 91M bytes)
 pkts bytes target     prot opt in     out     source               destination
50095   13M outtos     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain POSTROUTING (policy ACCEPT 9058K packets, 3331M bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain logdrop (27 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0   
LOG flags 0 level 6 prefix `Shorewall:man1918:DROP:''
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain man1918 (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 RETURN     all  --  *      *       0.0.0.0/0           
255.255.255.255
    0     0 DROP       all  --  *      *       0.0.0.0/0           
169.254.0.0/16
    0     0 logdrop    all  --  *      *       0.0.0.0/0           
172.16.0.0/12
    0     0 logdrop    all  --  *      *       0.0.0.0/0            192.0.2.0/24
    0     0 logdrop    all  --  *      *       0.0.0.0/0           
192.168.0.0/16
    0     0 logdrop    all  --  *      *       0.0.0.0/0            0.0.0.0/7
    0     0 logdrop    all  --  *      *       0.0.0.0/0            2.0.0.0/8
    0     0 logdrop    all  --  *      *       0.0.0.0/0            5.0.0.0/8
    0     0 logdrop    all  --  *      *       0.0.0.0/0            7.0.0.0/8
    0     0 logdrop    all  --  *      *       0.0.0.0/0            10.0.0.0/8
    0     0 logdrop    all  --  *      *       0.0.0.0/0            23.0.0.0/8
    0     0 logdrop    all  --  *      *       0.0.0.0/0            27.0.0.0/8
    0     0 logdrop    all  --  *      *       0.0.0.0/0            31.0.0.0/8
    0     0 logdrop    all  --  *      *       0.0.0.0/0            36.0.0.0/7
    0     0 logdrop    all  --  *      *       0.0.0.0/0            39.0.0.0/8
    0     0 logdrop    all  --  *      *       0.0.0.0/0            41.0.0.0/8
    0     0 logdrop    all  --  *      *       0.0.0.0/0            42.0.0.0/8
    0     0 logdrop    all  --  *      *       0.0.0.0/0            58.0.0.0/7
    0     0 logdrop    all  --  *      *       0.0.0.0/0            60.0.0.0/8
    0     0 logdrop    all  --  *      *       0.0.0.0/0            70.0.0.0/7
    0     0 logdrop    all  --  *      *       0.0.0.0/0            72.0.0.0/5
    0     0 logdrop    all  --  *      *       0.0.0.0/0            82.0.0.0/7
    0     0 logdrop    all  --  *      *       0.0.0.0/0            84.0.0.0/6
    0     0 logdrop    all  --  *      *       0.0.0.0/0            88.0.0.0/5
    0     0 logdrop    all  --  *      *       0.0.0.0/0            96.0.0.0/3
    0     0 logdrop    all  --  *      *       0.0.0.0/0            127.0.0.0/8
    0     0 logdrop    all  --  *      *       0.0.0.0/0            197.0.0.0/8
    0     0 logdrop    all  --  *      *       0.0.0.0/0            222.0.0.0/7
    0     0 logdrop    all  --  *      *       0.0.0.0/0            240.0.0.0/4

Chain outtos (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 TOS        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
tcp dpt:21 TOS set 0x10
    0     0 TOS        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
tcp spt:21 TOS set 0x10
    0     0 TOS        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
tcp spt:20 TOS set 0x08
    0     0 TOS        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
tcp dpt:20 TOS set 0x08

Chain pretos (1 references)
 pkts bytes target     prot opt in     out     source               destination
  106  5833 TOS        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
tcp dpt:21 TOS set 0x10
   54  4449 TOS        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
tcp spt:21 TOS set 0x10
  153  202K TOS        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
tcp spt:20 TOS set 0x08
   95  3816 TOS        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
tcp dpt:20 TOS set 0x08

tcp      6 43 TIME_WAIT src=10.1.32.45 dst=217.162.33.120 sport=2615 dport=6346
src=217.162.33.120 dst=66.9.109.133 sport=6346 dport=2615 [ASSURED] use=1
tcp      6 334236 ESTABLISHED src=10.1.32.241 dst=10.1.32.5 sport=3042 dport=139
src=10.1.32.5 dst=10.1.32.241 sport=139 dport=3042 [ASSURED] use=1
tcp      6 431884 ESTABLISHED src=10.1.32.5 dst=10.1.64.3 sport=1237 dport=445
src=10.1.64.3 dst=10.1.32.5 sport=445 dport=1237 [ASSURED] use=1
tcp      6 103 TIME_WAIT src=10.1.32.45 dst=68.67.233.25 sport=2663 dport=6346
src=68.67.233.25 dst=66.9.109.133 sport=6346 dport=2663 [ASSURED] use=1
tcp      6 96 TIME_WAIT src=10.1.32.57 dst=66.218.87.254 sport=1520 dport=80
src=66.218.87.254 dst=66.9.109.133 sport=80 dport=1520 [ASSURED] use=1
tcp      6 431998 ESTABLISHED src=10.1.32.45 dst=152.19.187.176 sport=3688
dport=6346 src=152.19.187.176 dst=66.9.109.133 sport=6346 dport=3688 [ASSURED]
use=1
tcp      6 59 TIME_WAIT src=10.1.32.57 dst=65.199.10.156 sport=1477 dport=80
src=65.199.10.156 dst=66.9.109.133 sport=80 dport=1477 [ASSURED] use=1
tcp      6 94 TIME_WAIT src=10.1.32.57 dst=66.218.75.128 sport=1494 dport=80
src=66.218.75.128 dst=66.9.109.133 sport=80 dport=1494 [ASSURED] use=1
tcp      6 72 TIME_WAIT src=10.1.32.7 dst=10.1.64.2 sport=4864 dport=8080
src=10.1.64.2 dst=10.1.32.7 sport=8080 dport=4864 [ASSURED] use=1
tcp      6 25 TIME_WAIT src=155.94.62.251 dst=66.9.109.150 sport=35886 dport=443
src=10.1.64.2 dst=155.94.62.251 sport=443 dport=35886 [ASSURED] use=1
udp      17 26 src=10.1.32.45 dst=68.82.206.21 sport=3580 dport=6346 [UNREPLIED]
src=68.82.206.21 dst=66.9.109.133 sport=6346 dport=3580 use=1
tcp      6 31 SYN_SENT src=10.1.32.45 dst=216.114.250.248 sport=2606 dport=6346
[UNREPLIED] src=216.114.250.248 dst=66.9.109.133 sport=6346 dport=2606 use=1
tcp      6 57 TIME_WAIT src=10.1.32.45 dst=12.226.211.81 sport=2629 dport=6346
src=12.226.211.81 dst=66.9.109.133 sport=6346 dport=2629 [ASSURED] use=1
tcp      6 110 TIME_WAIT src=10.1.32.57 dst=66.218.75.128 sport=1530 dport=80
src=66.218.75.128 dst=66.9.109.133 sport=80 dport=1530 [ASSURED] use=1
tcp      6 431940 ESTABLISHED src=10.1.32.57 dst=208.253.92.54 sport=1488
dport=80 src=208.253.92.54 dst=66.9.109.133 sport=80 dport=1488 [ASSURED] use=1
tcp      6 107 TIME_WAIT src=10.1.64.3 dst=10.1.32.5 sport=1635 dport=53
src=10.1.32.5 dst=10.1.64.3 sport=53 dport=1635 [ASSURED] use=1
tcp      6 4 TIME_WAIT src=10.1.32.45 dst=12.236.230.93 sport=2590 dport=6347
src=12.236.230.93 dst=66.9.109.133 sport=6347 dport=2590 [ASSURED] use=1
tcp      6 431991 ESTABLISHED src=10.1.32.57 dst=160.79.148.103 sport=1503
dport=80 src=160.79.148.103 dst=66.9.109.133 sport=80 dport=1503 [ASSURED] use=1
tcp      6 44 SYN_SENT src=10.1.32.45 dst=166.82.108.173 sport=2616 dport=6347
[UNREPLIED] src=166.82.108.173 dst=66.9.109.133 sport=6347 dport=2616 use=1
tcp      6 417919 ESTABLISHED src=10.1.64.2 dst=10.1.32.2 sport=1919 dport=445
src=10.1.32.2 dst=10.1.64.2 sport=445 dport=1919 [ASSURED] use=1
udp      17 21 src=10.1.32.127 dst=192.232.117.83 sport=9370 dport=370
[UNREPLIED] src=192.232.117.83 dst=66.9.109.133 sport=370 dport=9370 use=1
tcp      6 431998 ESTABLISHED src=10.1.32.45 dst=212.64.25.43 sport=2506
dport=14940 src=212.64.25.43 dst=66.9.109.133 sport=14940 dport=2506 [ASSURED]
use=1
udp      17 26 src=10.1.32.45 dst=66.191.121.193 sport=3580 dport=6346
[UNREPLIED] src=66.191.121.193 dst=66.9.109.133 sport=6346 dport=3580 use=1
udp      17 24 src=10.1.32.45 dst=66.214.46.159 sport=3580 dport=5145
[UNREPLIED] src=66.214.46.159 dst=66.9.109.133 sport=5145 dport=3580 use=1
udp      17 25 src=10.1.32.45 dst=63.229.133.151 sport=3580 dport=6346
[UNREPLIED] src=63.229.133.151 dst=66.9.109.133 sport=6346 dport=3580 use=1
tcp      6 431996 ESTABLISHED src=10.1.32.48 dst=205.188.7.68 sport=1690
dport=5190 src=205.188.7.68 dst=66.9.109.133 sport=5190 dport=1690 [ASSURED]
use=1
tcp      6 387551 ESTABLISHED src=10.1.32.57 dst=208.240.241.216 sport=4778
dport=443 src=208.240.241.216 dst=66.9.109.133 sport=443 dport=4778 [ASSURED]
use=1
udp      17 5 src=10.1.32.57 dst=160.79.5.130 sport=1516 dport=53
src=160.79.5.130 dst=66.9.109.133 sport=53 dport=1516 use=1
tcp      6 110 TIME_WAIT src=10.1.32.57 dst=66.218.75.128 sport=1533 dport=80
src=66.218.75.128 dst=66.9.109.133 sport=80 dport=1533 [ASSURED] use=1
tcp      6 82 SYN_SENT src=10.1.32.45 dst=80.218.255.190 sport=2643 dport=6346
[UNREPLIED] src=80.218.255.190 dst=66.9.109.133 sport=6346 dport=2643 use=1
tcp      6 431991 ESTABLISHED src=10.1.32.57 dst=160.79.148.103 sport=1506
dport=80 src=160.79.148.103 dst=66.9.109.133 sport=80 dport=1506 [ASSURED] use=1
tcp      6 70 TIME_WAIT src=10.1.32.45 dst=172.162.220.67 sport=2641 dport=8202
src=172.162.220.67 dst=66.9.109.133 sport=8202 dport=2641 [ASSURED] use=1
tcp      6 95 TIME_WAIT src=10.1.32.45 dst=64.136.192.245 sport=2658 dport=6346
src=64.136.192.245 dst=66.9.109.133 sport=6346 dport=2658 [ASSURED] use=1
tcp      6 80 TIME_WAIT src=10.1.32.45 dst=209.248.71.174 sport=2647 dport=6347
src=209.248.71.174 dst=66.9.109.133 sport=6347 dport=2647 [ASSURED] use=1
udp      17 28 src=10.1.32.5 dst=255.255.255.255 sport=67 dport=68 [UNREPLIED]
src=255.255.255.255 dst=10.1.32.5 sport=68 dport=67 use=1
tcp      6 86 SYN_SENT src=10.1.32.45 dst=80.194.96.115 sport=2650 dport=6347
[UNREPLIED] src=80.194.96.115 dst=66.9.109.133 sport=6347 dport=2650 use=1
udp      17 28 src=10.1.32.5 dst=255.255.255.255 sport=68 dport=67 [UNREPLIED]
src=255.255.255.255 dst=10.1.32.5 sport=67 dport=68 use=1
udp      17 24 src=10.1.32.45 dst=65.60.226.205 sport=3580 dport=6346
[UNREPLIED] src=65.60.226.205 dst=66.9.109.133 sport=6346 dport=3580 use=1
udp      17 16 src=10.1.32.41 dst=10.1.32.255 sport=138 dport=138 [UNREPLIED]
src=10.1.32.255 dst=10.1.32.41 sport=138 dport=138 use=1
tcp      6 78 TIME_WAIT src=10.1.32.45 dst=212.60.58.102 sport=2642 dport=6346
src=212.60.58.102 dst=66.9.109.133 sport=6346 dport=2642 [ASSURED] use=1
tcp      6 397848 ESTABLISHED src=10.1.32.242 dst=10.1.32.101 sport=4256
dport=5900 src=10.1.32.101 dst=10.1.32.242 sport=5900 dport=4256 [ASSURED] use=1
tcp      6 95 TIME_WAIT src=10.1.32.57 dst=66.218.87.254 sport=1526 dport=80
src=66.218.87.254 dst=66.9.109.133 sport=80 dport=1526 [ASSURED] use=1
tcp      6 94 SYN_SENT src=10.1.32.45 dst=137.69.55.98 sport=2654 dport=6346
[UNREPLIED] src=137.69.55.98 dst=66.9.109.133 sport=6346 dport=2654 use=1
udp      17 179 src=10.1.32.45 dst=140.88.71.107 sport=3580 dport=33920
src=140.88.71.107 dst=66.9.109.133 sport=33920 dport=3580 [ASSURED] use=1
tcp      6 390787 ESTABLISHED src=10.1.32.240 dst=10.1.32.101 sport=4233
dport=5900 src=10.1.32.101 dst=10.1.32.240 sport=5900 dport=4233 [ASSURED] use=1
tcp      6 431965 ESTABLISHED src=10.1.32.57 dst=216.239.53.99 sport=1491
dport=80 src=216.239.53.99 dst=66.9.109.133 sport=80 dport=1491 [ASSURED] use=1
tcp      6 431970 ESTABLISHED src=10.1.32.45 dst=63.150.145.202 sport=2657
dport=80 src=63.150.145.202 dst=66.9.109.133 sport=80 dport=2657 [ASSURED] use=1
tcp      6 57 SYN_SENT src=10.1.32.45 dst=80.15.34.135 sport=2628 dport=51736
[UNREPLIED] src=80.15.34.135 dst=66.9.109.133 sport=51736 dport=2628 use=1
udp      17 26 src=10.1.32.45 dst=68.13.71.24 sport=3580 dport=6346 [UNREPLIED]
src=68.13.71.24 dst=66.9.109.133 sport=6346 dport=3580 use=1
tcp      6 59 TIME_WAIT src=10.1.32.57 dst=64.154.81.15 sport=1482 dport=80
src=64.154.81.15 dst=66.9.109.133 sport=80 dport=1482 [ASSURED] use=1
tcp      6 118 SYN_SENT src=10.1.32.45 dst=169.254.101.152 sport=2668 dport=6347
[UNREPLIED] src=169.254.101.152 dst=66.9.109.133 sport=6347 dport=2668 use=1
udp      17 29 src=10.1.32.45 dst=66.92.79.7 sport=3580 dport=6346 [UNREPLIED]
src=66.92.79.7 dst=66.9.109.133 sport=6346 dport=3580 use=1
tcp      6 58 TIME_WAIT src=10.1.32.57 dst=213.244.183.204 sport=1467 dport=80
src=213.244.183.204 dst=66.9.109.133 sport=80 dport=1467 [ASSURED] use=1
tcp      6 319219 ESTABLISHED src=10.1.32.240 dst=10.1.32.3 sport=2026
dport=1103 src=10.1.32.3 dst=10.1.32.240 sport=1103 dport=2026 [ASSURED] use=1
tcp      6 99 SYN_SENT src=10.1.32.45 dst=213.45.16.43 sport=2656 dport=6346
[UNREPLIED] src=213.45.16.43 dst=66.9.109.133 sport=6346 dport=2656 use=1
udp      17 27 src=10.1.32.136 dst=10.1.32.255 sport=138 dport=138 [UNREPLIED]
src=10.1.32.255 dst=10.1.32.136 sport=138 dport=138 use=1
udp      17 24 src=10.1.32.45 dst=66.189.96.196 sport=3580 dport=6347
[UNREPLIED] src=66.189.96.196 dst=66.9.109.133 sport=6347 dport=3580 use=1
tcp      6 95 TIME_WAIT src=10.1.32.57 dst=66.218.75.139 sport=1513 dport=80
src=66.218.75.139 dst=66.9.109.133 sport=80 dport=1513 [ASSURED] use=1
tcp      6 11 SYN_SENT src=10.1.32.45 dst=64.167.238.221 sport=2597 dport=6346
[UNREPLIED] src=64.167.238.221 dst=66.9.109.133 sport=6346 dport=2597 use=1
udp      17 5 src=10.1.32.45 dst=209.197.170.182 sport=3580 dport=1211
src=209.197.170.182 dst=66.9.109.133 sport=1211 dport=3580 use=1
tcp      6 13 TIME_WAIT src=10.1.32.45 dst=67.80.121.141 sport=2600 dport=6347
src=67.80.121.141 dst=66.9.109.133 sport=6347 dport=2600 [ASSURED] use=1
udp      17 6 src=10.1.32.45 dst=172.185.18.198 sport=3580 dport=28058
src=172.185.18.198 dst=66.9.109.133 sport=28058 dport=3580 use=1
udp      17 4 src=10.1.32.57 dst=160.79.5.130 sport=1509 dport=53
src=160.79.5.130 dst=66.9.109.133 sport=53 dport=1509 use=1
tcp      6 95 TIME_WAIT src=10.1.32.57 dst=66.218.87.254 sport=1529 dport=80
src=66.218.87.254 dst=66.9.109.133 sport=80 dport=1529 [ASSURED] use=1
tcp      6 42 TIME_WAIT src=10.1.32.45 dst=66.147.145.110 sport=2619 dport=6350
src=66.147.145.110 dst=66.9.109.133 sport=6350 dport=2619 [ASSURED] use=1
udp      17 26 src=10.1.32.45 dst=67.114.115.245 sport=3580 dport=6346
[UNREPLIED] src=67.114.115.245 dst=66.9.109.133 sport=6346 dport=3580 use=1
tcp      6 53 SYN_SENT src=10.1.32.45 dst=24.35.69.6 sport=2625 dport=6346
[UNREPLIED] src=24.35.69.6 dst=66.9.109.133 sport=6346 dport=2625 use=1
udp      17 3 src=10.1.32.45 dst=128.123.124.166 sport=3580 dport=11182
src=128.123.124.166 dst=66.9.109.133 sport=11182 dport=3580 use=1
udp      17 27 src=10.1.32.45 dst=155.225.130.189 sport=3580 dport=32179
[UNREPLIED] src=155.225.130.189 dst=66.9.109.133 sport=32179 dport=3580 use=1
tcp      6 9 SYN_SENT src=10.1.32.45 dst=67.35.20.13 sport=2595 dport=6348
[UNREPLIED] src=67.35.20.13 dst=66.9.109.133 sport=6348 dport=2595 use=1
tcp      6 389785 ESTABLISHED src=10.1.32.45 dst=200.77.35.174 sport=4056
dport=6346 src=200.77.35.174 dst=66.9.109.133 sport=6346 dport=4056 [ASSURED]
use=1
udp      17 28 src=10.1.32.45 dst=195.158.106.133 sport=3580 dport=23569
[UNREPLIED] src=195.158.106.133 dst=66.9.109.133 sport=23569 dport=3580 use=1
tcp      6 8 TIME_WAIT src=10.1.32.57 dst=207.171.182.16 sport=1408 dport=80
src=207.171.182.16 dst=66.9.109.133 sport=80 dport=1408 [ASSURED] use=1
tcp      6 22 SYN_SENT src=10.1.32.45 dst=80.181.168.22 sport=2601 dport=6346
[UNREPLIED] src=80.181.168.22 dst=66.9.109.133 sport=6346 dport=2601 use=1
tcp      6 58 TIME_WAIT src=10.1.32.57 dst=65.199.10.156 sport=1476 dport=80
src=65.199.10.156 dst=66.9.109.133 sport=80 dport=1476 [ASSURED] use=1
tcp      6 32 TIME_WAIT src=10.1.32.91 dst=63.175.146.25 sport=4029 dport=80
src=63.175.146.25 dst=66.9.109.133 sport=80 dport=4029 [ASSURED] use=1
tcp      6 319298 ESTABLISHED src=10.1.32.240 dst=10.1.32.3 sport=2031
dport=1114 src=10.1.32.3 dst=10.1.32.240 sport=1114 dport=2031 [ASSURED] use=1
udp      17 27 src=10.1.32.45 dst=66.72.175.20 sport=3580 dport=6346 [UNREPLIED]
src=66.72.175.20 dst=66.9.109.133 sport=6346 dport=3580 use=1
tcp      6 58 CLOSE_WAIT src=10.1.32.57 dst=208.253.92.54 sport=1487 dport=80
src=208.253.92.54 dst=66.9.109.133 sport=80 dport=1487 [ASSURED] use=1
tcp      6 19 TIME_WAIT src=10.1.32.45 dst=68.34.89.8 sport=2602 dport=6346
src=68.34.89.8 dst=66.9.109.133 sport=6346 dport=2602 [ASSURED] use=1
tcp      6 431998 ESTABLISHED src=10.1.32.45 dst=213.196.209.116 sport=2400
dport=6346 src=213.196.209.116 dst=66.9.109.133 sport=6346 dport=2400 [ASSURED]
use=1
tcp      6 23 SYN_SENT src=10.1.32.45 dst=24.85.207.211 sport=2604 dport=6346
[UNREPLIED] src=24.85.207.211 dst=66.9.109.133 sport=6346 dport=2604 use=1
tcp      6 118 SYN_SENT src=10.1.32.45 dst=66.157.208.137 sport=2670 dport=6346
[UNREPLIED] src=66.157.208.137 dst=66.9.109.133 sport=6346 dport=2670 use=1
tcp      6 432000 ESTABLISHED src=10.1.32.240 dst=10.1.32.14 sport=1110 dport=22
src=10.1.32.14 dst=10.1.32.240 sport=22 dport=1110 [ASSURED] use=1
tcp      6 431979 ESTABLISHED src=10.1.32.48 dst=64.12.27.151 sport=2727
dport=5190 src=64.12.27.151 dst=66.9.109.133 sport=5190 dport=2727 [ASSURED]
use=1
tcp      6 415071 ESTABLISHED src=10.1.32.94 dst=10.1.64.3 sport=4337 dport=139
src=10.1.64.3 dst=10.1.32.94 sport=139 dport=4337 [ASSURED] use=1
tcp      6 116 SYN_SENT src=10.1.32.45 dst=68.39.212.186 sport=2671 dport=6346
[UNREPLIED] src=68.39.212.186 dst=66.9.109.133 sport=6346 dport=2671 use=1
tcp      6 415078 ESTABLISHED src=10.1.64.2 dst=10.1.32.2 sport=4575 dport=1433
src=10.1.32.2 dst=10.1.64.2 sport=1433 dport=4575 [ASSURED] use=1
udp      17 24 src=10.1.32.45 dst=216.151.70.235 sport=3580 dport=6346
[UNREPLIED] src=216.151.70.235 dst=66.9.109.133 sport=6346 dport=3580 use=1
tcp      6 399166 ESTABLISHED src=10.1.32.139 dst=10.1.64.2 sport=3975
dport=3389 src=10.1.64.2 dst=10.1.32.139 sport=3389 dport=3975 [ASSURED] use=1
tcp      6 57 TIME_WAIT src=10.1.32.57 dst=64.237.98.100 sport=1481 dport=80
src=64.237.98.100 dst=66.9.109.133 sport=80 dport=1481 [ASSURED] use=1
tcp      6 387544 ESTABLISHED src=10.1.32.57 dst=208.240.241.216 sport=4777
dport=443 src=208.240.241.216 dst=66.9.109.133 sport=443 dport=4777 [ASSURED]
use=1
tcp      6 431999 ESTABLISHED src=10.1.32.57 dst=216.35.221.84 sport=1294
dport=1755 src=216.35.221.84 dst=66.9.109.133 sport=1755 dport=1294 [ASSURED]
use=1
tcp      6 109 TIME_WAIT src=10.1.32.57 dst=66.218.75.128 sport=1532 dport=80
src=66.218.75.128 dst=66.9.109.133 sport=80 dport=1532 [ASSURED] use=1
tcp      6 71 SYN_SENT src=10.1.32.45 dst=68.107.137.213 sport=2640 dport=6346
[UNREPLIED] src=68.107.137.213 dst=66.9.109.133 sport=6346 dport=2640 use=1
udp      17 1 src=10.1.32.57 dst=160.79.5.130 sport=1492 dport=53
src=160.79.5.130 dst=66.9.109.133 sport=53 dport=1492 use=1
tcp      6 93 TIME_WAIT src=10.1.32.57 dst=66.218.87.254 sport=1512 dport=80
src=66.218.87.254 dst=66.9.109.133 sport=80 dport=1512 [ASSURED] use=1
udp      17 29 src=10.1.32.45 dst=157.158.56.66 sport=3580 dport=6346
[UNREPLIED] src=157.158.56.66 dst=66.9.109.133 sport=6346 dport=3580 use=1
tcp      6 431989 ESTABLISHED src=10.1.32.57 dst=160.79.148.103 sport=1505
dport=80 src=160.79.148.103 dst=66.9.109.133 sport=80 dport=1505 [ASSURED] use=1
tcp      6 431994 ESTABLISHED src=10.1.32.45 dst=65.165.207.28 sport=1309
dport=14461 src=65.165.207.28 dst=66.9.109.133 sport=14461 dport=1309 [ASSURED]
use=1
tcp      6 24 SYN_SENT src=10.1.32.45 dst=12.217.29.109 sport=2605 dport=6347
[UNREPLIED] src=12.217.29.109 dst=66.9.109.133 sport=6347 dport=2605 use=1
tcp      6 0 TIME_WAIT src=10.1.32.45 dst=12.239.200.17 sport=2592 dport=6346
src=12.239.200.17 dst=66.9.109.133 sport=6346 dport=2592 [ASSURED] use=1
udp      17 2 src=10.1.32.45 dst=204.38.203.152 sport=3580 dport=6346
src=204.38.203.152 dst=66.9.109.133 sport=6346 dport=3580 use=1
tcp      6 100 SYN_SENT src=10.1.32.45 dst=12.233.57.109 sport=2659 dport=6346
[UNREPLIED] src=12.233.57.109 dst=66.9.109.133 sport=6346 dport=2659 use=1
tcp      6 117 SYN_SENT src=10.1.32.45 dst=66.69.39.110 sport=2669 dport=6349
[UNREPLIED] src=66.69.39.110 dst=66.9.109.133 sport=6349 dport=2669 use=1
udp      17 169 src=10.1.32.5 dst=160.79.6.130 sport=1184 dport=53
src=160.79.6.130 dst=66.9.109.133 sport=53 dport=1184 [ASSURED] use=1
tcp      6 93 TIME_WAIT src=10.1.32.57 dst=66.218.75.128 sport=1522 dport=80
src=66.218.75.128 dst=66.9.109.133 sport=80 dport=1522 [ASSURED] use=1
tcp      6 93 TIME_WAIT src=10.1.32.57 dst=66.218.87.254 sport=1525 dport=80
src=66.218.87.254 dst=66.9.109.133 sport=80 dport=1525 [ASSURED] use=1
tcp      6 61 TIME_WAIT src=10.1.32.45 dst=63.224.206.83 sport=2633 dport=6346
src=63.224.206.83 dst=66.9.109.133 sport=6346 dport=2633 [ASSURED] use=1
udp      17 28 src=10.1.32.45 dst=206.180.128.116 sport=3580 dport=6346
[UNREPLIED] src=206.180.128.116 dst=66.9.109.133 sport=6346 dport=3580 use=1
tcp      6 415355 ESTABLISHED src=10.1.32.139 dst=64.12.25.232 sport=4547
dport=5190 src=64.12.25.232 dst=66.9.109.133 sport=5190 dport=4547 [ASSURED]
use=1
udp      17 3 src=10.1.32.57 dst=160.79.5.130 sport=1518 dport=53
src=160.79.5.130 dst=66.9.109.133 sport=53 dport=1518 use=1
tcp      6 109 TIME_WAIT src=10.1.32.57 dst=64.58.77.173 sport=1538 dport=80
src=64.58.77.173 dst=66.9.109.133 sport=80 dport=1538 [ASSURED] use=1
udp      17 24 src=10.1.32.45 dst=24.103.148.46 sport=3580 dport=6346
[UNREPLIED] src=24.103.148.46 dst=66.9.109.133 sport=6346 dport=3580 use=1
udp      17 2 src=10.1.32.57 dst=160.79.5.130 sport=1495 dport=53
src=160.79.5.130 dst=66.9.109.133 sport=53 dport=1495 use=1
tcp      6 109 TIME_WAIT src=10.1.32.57 dst=66.218.75.139 sport=1537 dport=80
src=66.218.75.139 dst=66.9.109.133 sport=80 dport=1537 [ASSURED] use=1
tcp      6 93 TIME_WAIT src=10.1.32.57 dst=66.218.87.254 sport=1515 dport=80
src=66.218.87.254 dst=66.9.109.133 sport=80 dport=1515 [ASSURED] use=1
tcp      6 22 TIME_WAIT src=10.1.32.45 dst=66.103.50.49 sport=2599 dport=6348
src=66.103.50.49 dst=66.9.109.133 sport=6348 dport=2599 [ASSURED] use=1
tcp      6 40 TIME_WAIT src=10.1.32.45 dst=63.242.246.60 sport=2618 dport=6346
src=63.242.246.60 dst=66.9.109.133 sport=6346 dport=2618 [ASSURED] use=1
udp      17 11 src=10.1.32.45 dst=152.19.187.176 sport=3580 dport=6346
[UNREPLIED] src=152.19.187.176 dst=66.9.109.133 sport=6346 dport=3580 use=1
tcp      6 372203 ESTABLISHED src=10.1.32.241 dst=10.1.32.5 sport=3237 dport=139
src=10.1.32.5 dst=10.1.32.241 sport=139 dport=3237 [ASSURED] use=1
tcp      6 88 SYN_SENT src=10.1.32.45 dst=81.132.78.81 sport=2652 dport=6346
[UNREPLIED] src=81.132.78.81 dst=66.9.109.133 sport=6346 dport=2652 use=1
tcp      6 94 TIME_WAIT src=10.1.32.57 dst=66.218.87.254 sport=1528 dport=80
src=66.218.87.254 dst=66.9.109.133 sport=80 dport=1528 [ASSURED] use=1
udp      17 5 src=10.1.32.45 dst=212.179.245.15 sport=3580 dport=32944
src=212.179.245.15 dst=66.9.109.133 sport=32944 dport=3580 use=1
tcp      6 104 SYN_SENT src=10.1.32.45 dst=12.107.13.10 sport=2661 dport=6346
[UNREPLIED] src=12.107.13.10 dst=66.9.109.133 sport=6346 dport=2661 use=1
tcp      6 26 TIME_WAIT src=10.1.32.57 dst=216.157.225.230 sport=1449 dport=80
src=216.157.225.230 dst=66.9.109.133 sport=80 dport=1449 [ASSURED] use=1
tcp      6 108 TIME_WAIT src=10.1.32.45 dst=12.241.145.121 sport=2666 dport=6346
src=12.241.145.121 dst=66.9.109.133 sport=6346 dport=2666 [ASSURED] use=1
tcp      6 431960 ESTABLISHED src=10.1.32.48 dst=64.12.25.203 sport=1689
dport=5190 src=64.12.25.203 dst=66.9.109.133 sport=5190 dport=1689 [ASSURED]
use=1
tcp      6 40 TIME_WAIT src=10.1.32.45 dst=24.81.22.234 sport=2621 dport=6346
src=24.81.22.234 dst=66.9.109.133 sport=6346 dport=2621 [ASSURED] use=1
udp      17 25 src=10.1.32.45 dst=172.197.52.40 sport=3580 dport=6346
[UNREPLIED] src=172.197.52.40 dst=66.9.109.133 sport=6346 dport=3580 use=1
tcp      6 56 TIME_WAIT src=10.1.32.45 dst=68.155.35.88 sport=2631 dport=6346
src=68.155.35.88 dst=66.9.109.133 sport=6346 dport=2631 [ASSURED] use=1
udp      17 29 src=10.1.32.45 dst=24.242.205.96 sport=3580 dport=6346
[UNREPLIED] src=24.242.205.96 dst=66.9.109.133 sport=6346 dport=3580 use=1
tcp      6 53 TIME_WAIT src=155.94.62.251 dst=66.9.109.150 sport=38941 dport=443
src=10.1.64.2 dst=155.94.62.251 sport=443 dport=38941 [ASSURED] use=1
tcp      6 81 TIME_WAIT src=10.1.32.45 dst=208.59.154.82 sport=2651 dport=6346
src=208.59.154.82 dst=66.9.109.133 sport=6346 dport=2651 [ASSURED] use=1
tcp      6 4 TIME_WAIT src=10.1.32.57 dst=207.171.182.16 sport=1407 dport=80
src=207.171.182.16 dst=66.9.109.133 sport=80 dport=1407 [ASSURED] use=1
udp      17 2 src=10.1.32.57 dst=160.79.5.130 sport=1498 dport=53
src=160.79.5.130 dst=66.9.109.133 sport=53 dport=1498 use=1
tcp      6 109 TIME_WAIT src=10.1.32.57 dst=66.218.75.139 sport=1540 dport=80
src=66.218.75.139 dst=66.9.109.133 sport=80 dport=1540 [ASSURED] use=1
tcp      6 431989 ESTABLISHED src=10.1.32.57 dst=160.79.148.103 sport=1536
dport=80 src=160.79.148.103 dst=66.9.109.133 sport=80 dport=1536 [ASSURED] use=1
udp      17 24 src=10.1.32.45 dst=80.195.114.154 sport=3580 dport=6346
[UNREPLIED] src=80.195.114.154 dst=66.9.109.133 sport=6346 dport=3580 use=1
tcp      6 393232 ESTABLISHED src=10.1.32.5 dst=10.1.64.3 sport=3052 dport=445
src=10.1.64.3 dst=10.1.32.5 sport=445 dport=3052 [ASSURED] use=1
tcp      6 55 TIME_WAIT src=10.1.32.57 dst=216.73.86.90 sport=1466 dport=80
src=216.73.86.90 dst=66.9.109.133 sport=80 dport=1466 [ASSURED] use=1
udp      17 27 src=192.168.1.1 dst=128.0.0.1 sport=137 dport=137 [UNREPLIED]
src=128.0.0.1 dst=192.168.1.1 sport=137 dport=137 use=1
tcp      6 119 SYN_SENT src=10.1.32.45 dst=66.57.218.42 sport=2673 dport=6346
[UNREPLIED] src=66.57.218.42 dst=66.9.109.133 sport=6346 dport=2673 use=1
tcp      6 105 SYN_SENT src=10.1.32.45 dst=195.36.248.27 sport=2662 dport=6346
[UNREPLIED] src=195.36.248.27 dst=66.9.109.133 sport=6346 dport=2662 use=1
tcp      6 8 CLOSE src=10.1.32.57 dst=208.253.92.54 sport=1486 dport=80
src=208.253.92.54 dst=66.9.109.133 sport=80 dport=1486 [ASSURED] use=1
tcp      6 431984 ESTABLISHED src=10.1.64.3 dst=146.243.59.19 sport=1636
dport=25 src=146.243.59.19 dst=66.9.109.141 sport=25 dport=1636 [ASSURED] use=1
tcp      6 431941 ESTABLISHED src=10.1.32.57 dst=66.35.229.241 sport=1490
dport=80 src=66.35.229.241 dst=66.9.109.133 sport=80 dport=1490 [ASSURED] use=1
tcp      6 55 TIME_WAIT src=10.1.32.57 dst=64.237.98.100 sport=1456 dport=80
src=64.237.98.100 dst=66.9.109.133 sport=80 dport=1456 [ASSURED] use=1
tcp      6 431915 ESTABLISHED src=10.1.64.2 dst=10.1.32.5 sport=1940 dport=445
src=10.1.32.5 dst=10.1.64.2 sport=445 dport=1940 [ASSURED] use=1
tcp      6 431793 ESTABLISHED src=68.160.152.211 dst=66.9.109.150 sport=1076
dport=1723 src=66.9.109.150 dst=68.160.152.211 sport=1723 dport=1076 [ASSURED]
use=1
udp      17 25 src=10.1.32.45 dst=24.50.48.81 sport=3580 dport=6346 [UNREPLIED]
src=24.50.48.81 dst=66.9.109.133 sport=6346 dport=3580 use=1
udp      17 27 src=10.1.32.45 dst=64.91.59.100 sport=3580 dport=6346 [UNREPLIED]
src=64.91.59.100 dst=66.9.109.133 sport=6346 dport=3580 use=1
udp      17 23 src=10.1.32.45 dst=217.233.91.37 sport=3580 dport=6346
[UNREPLIED] src=217.233.91.37 dst=66.9.109.133 sport=6346 dport=3580 use=1
tcp      6 406728 ESTABLISHED src=10.1.64.2 dst=10.1.32.57 sport=3131 dport=139
src=10.1.32.57 dst=10.1.64.2 sport=139 dport=3131 [ASSURED] use=1
tcp      6 56 TIME_WAIT src=10.1.32.57 dst=213.244.183.211 sport=1472 dport=80
src=213.244.183.211 dst=66.9.109.133 sport=80 dport=1472 [ASSURED] use=1
tcp      6 178541 ESTABLISHED src=10.1.32.240 dst=10.1.32.139 sport=1126
dport=139 src=10.1.32.139 dst=10.1.32.240 sport=139 dport=1126 [ASSURED] use=1
udp      17 2 src=10.1.32.57 dst=160.79.5.130 sport=1501 dport=53
src=160.79.5.130 dst=66.9.109.133 sport=53 dport=1501 use=1
tcp      6 93 TIME_WAIT src=10.1.32.57 dst=66.218.87.254 sport=1521 dport=80
src=66.218.87.254 dst=66.9.109.133 sport=80 dport=1521 [ASSURED] use=1
tcp      6 13 TIME_WAIT src=10.1.32.57 dst=66.135.194.135 sport=1419 dport=80
src=66.135.194.135 dst=66.9.109.133 sport=80 dport=1419 [ASSURED] use=1
tcp      6 56 TIME_WAIT src=10.1.32.57 dst=65.199.10.156 sport=1478 dport=80
src=65.199.10.156 dst=66.9.109.133 sport=80 dport=1478 [ASSURED] use=1
tcp      6 393231 ESTABLISHED src=10.1.32.5 dst=10.1.64.2 sport=3055 dport=445
src=10.1.64.2 dst=10.1.32.5 sport=445 dport=3055 [ASSURED] use=1
udp      17 126 src=10.1.32.45 dst=217.136.15.49 sport=3580 dport=6230
src=217.136.15.49 dst=66.9.109.133 sport=6230 dport=3580 [ASSURED] use=1
udp      17 29 src=10.1.32.97 dst=205.105.21.192 sport=137 dport=137 [UNREPLIED]
src=205.105.21.192 dst=66.9.109.133 sport=137 dport=137 use=1
udp      17 16 src=10.1.32.97 dst=205.105.21.193 sport=137 dport=137 [UNREPLIED]
src=205.105.21.193 dst=66.9.109.133 sport=137 dport=137 use=1
tcp      6 107 TIME_WAIT src=10.1.32.57 dst=66.218.75.128 sport=1531 dport=80
src=66.218.75.128 dst=66.9.109.133 sport=80 dport=1531 [ASSURED] use=1
tcp      6 35 TIME_WAIT src=10.1.32.45 dst=24.129.46.233 sport=2613 dport=6348
src=24.129.46.233 dst=66.9.109.133 sport=6348 dport=2613 [ASSURED] use=1
tcp      6 92 TIME_WAIT src=10.1.32.57 dst=66.218.87.254 sport=1511 dport=80
src=66.218.87.254 dst=66.9.109.133 sport=80 dport=1511 [ASSURED] use=1
tcp      6 91 TIME_WAIT src=10.1.32.45 dst=66.73.9.123 sport=2653 dport=6347
src=66.73.9.123 dst=66.9.109.133 sport=6347 dport=2653 [ASSURED] use=1
tcp      6 55 TIME_WAIT src=10.1.32.57 dst=64.237.98.100 sport=1459 dport=80
src=64.237.98.100 dst=66.9.109.133 sport=80 dport=1459 [ASSURED] use=1
tcp      6 431987 ESTABLISHED src=10.1.32.57 dst=160.79.148.103 sport=1504
dport=80 src=160.79.148.103 dst=66.9.109.133 sport=80 dport=1504 [ASSURED] use=1
tcp      6 67 SYN_SENT src=10.1.32.45 dst=24.211.14.148 sport=2635 dport=6348
[UNREPLIED] src=24.211.14.148 dst=66.9.109.133 sport=6348 dport=2635 use=1
udp      17 28 src=10.1.32.45 dst=165.190.89.135 sport=3580 dport=9582
[UNREPLIED] src=165.190.89.135 dst=66.9.109.133 sport=9582 dport=3580 use=1
udp      17 5 src=10.1.32.45 dst=213.168.105.41 sport=3580 dport=6346
[UNREPLIED] src=213.168.105.41 dst=66.9.109.133 sport=6346 dport=3580 use=1
udp      17 28 src=10.1.32.45 dst=165.190.89.152 sport=3580 dport=9224
[UNREPLIED] src=165.190.89.152 dst=66.9.109.133 sport=9224 dport=3580 use=1
tcp      6 41 SYN_SENT src=10.1.32.45 dst=24.102.244.62 sport=2617 dport=6346
[UNREPLIED] src=24.102.244.62 dst=66.9.109.133 sport=6346 dport=2617 use=1
tcp      6 92 TIME_WAIT src=10.1.32.57 dst=66.218.87.254 sport=1524 dport=80
src=66.218.87.254 dst=66.9.109.133 sport=80 dport=1524 [ASSURED] use=1
tcp      6 33 SYN_SENT src=10.1.32.45 dst=80.11.87.199 sport=2610 dport=51736
[UNREPLIED] src=80.11.87.199 dst=66.9.109.133 sport=51736 dport=2610 use=1
udp      17 12 src=10.1.32.45 dst=217.83.10.213 sport=3580 dport=1161
src=217.83.10.213 dst=66.9.109.133 sport=1161 dport=3580 use=1
udp      17 30 src=10.1.32.68 dst=10.1.32.255 sport=137 dport=137 [UNREPLIED]
src=10.1.32.255 dst=10.1.32.68 sport=137 dport=137 use=1
udp      17 28 src=10.1.32.45 dst=24.50.97.252 sport=3580 dport=6346 [UNREPLIED]
src=24.50.97.252 dst=66.9.109.133 sport=6346 dport=3580 use=1
tcp      6 431955 ESTABLISHED src=10.1.32.57 dst=66.35.229.241 sport=1460
dport=80 src=66.35.229.241 dst=66.9.109.133 sport=80 dport=1460 [ASSURED] use=1
udp      17 19 src=10.1.32.97 dst=10.1.32.255 sport=137 dport=137 [UNREPLIED]
src=10.1.32.255 dst=10.1.32.97 sport=137 dport=137 use=1
udp      17 18 src=10.1.32.116 dst=10.1.32.255 sport=137 dport=137 [UNREPLIED]
src=10.1.32.255 dst=10.1.32.116 sport=137 dport=137 use=1
tcp      6 425491 ESTABLISHED src=10.1.32.139 dst=66.9.109.130 sport=4859
dport=22 src=66.9.109.130 dst=10.1.32.139 sport=22 dport=4859 [ASSURED] use=1
tcp      6 431950 ESTABLISHED src=68.160.152.211 dst=66.9.109.150 sport=1105
dport=1723 src=66.9.109.150 dst=68.160.152.211 sport=1723 dport=1105 [ASSURED]
use=1
tcp      6 91 TIME_WAIT src=10.1.32.57 dst=66.218.87.254 sport=1514 dport=80
src=66.218.87.254 dst=66.9.109.133 sport=80 dport=1514 [ASSURED] use=1
udp      17 25 src=10.1.32.136 dst=10.1.32.255 sport=137 dport=137 [UNREPLIED]
src=10.1.32.255 dst=10.1.32.136 sport=137 dport=137 use=1
tcp      6 107 SYN_SENT src=10.1.32.45 dst=192.2.80.151 sport=2664 dport=6346
[UNREPLIED] src=192.2.80.151 dst=66.9.109.133 sport=6346 dport=2664 use=1
udp      17 23 src=10.1.32.45 dst=24.130.73.160 sport=3580 dport=6346
[UNREPLIED] src=24.130.73.160 dst=66.9.109.133 sport=6346 dport=3580 use=1
udp      17 9 src=10.1.32.150 dst=10.1.32.255 sport=137 dport=137 [UNREPLIED]
src=10.1.32.255 dst=10.1.32.150 sport=137 dport=137 use=1
tcp      6 59 TIME_WAIT src=10.1.32.45 dst=24.205.157.226 sport=2630 dport=6348
src=24.205.157.226 dst=66.9.109.133 sport=6348 dport=2630 [ASSURED] use=1
tcp      6 101 SYN_SENT src=10.1.32.45 dst=216.165.11.50 sport=2660 dport=6346
[UNREPLIED] src=216.165.11.50 dst=66.9.109.133 sport=6346 dport=2660 use=1
tcp      6 103 TIME_WAIT src=10.1.32.45 dst=65.29.48.236 sport=2665 dport=6348
src=65.29.48.236 dst=66.9.109.133 sport=6348 dport=2665 [ASSURED] use=1
udp      17 26 src=10.1.32.45 dst=24.222.164.88 sport=3580 dport=6346
[UNREPLIED] src=24.222.164.88 dst=66.9.109.133 sport=6346 dport=3580 use=1
udp      17 28 src=10.1.32.45 dst=207.5.161.100 sport=3580 dport=6346
[UNREPLIED] src=207.5.161.100 dst=66.9.109.133 sport=6346 dport=3580 use=1
unknown  47 600 src=66.9.109.150 dst=68.160.152.211 src=68.160.152.211
dst=66.9.109.150 use=1
udp      17 1 src=10.1.32.57 dst=160.79.5.130 sport=1507 dport=53
src=160.79.5.130 dst=66.9.109.133 sport=53 dport=1507 use=1
tcp      6 92 TIME_WAIT src=10.1.32.57 dst=66.218.87.254 sport=1527 dport=80
src=66.218.87.254 dst=66.9.109.133 sport=80 dport=1527 [ASSURED] use=1
udp      17 1 src=10.1.32.45 dst=131.204.207.14 sport=3580 dport=41637
src=131.204.207.14 dst=66.9.109.133 sport=41637 dport=3580 use=1
tcp      6 30 SYN_SENT src=10.1.32.45 dst=80.202.49.215 sport=2608 dport=6346
[UNREPLIED] src=80.202.49.215 dst=66.9.109.133 sport=6346 dport=2608 use=1
udp      17 23 src=10.1.32.45 dst=80.193.52.127 sport=3580 dport=6346
[UNREPLIED] src=80.193.52.127 dst=66.9.109.133 sport=6346 dport=3580 use=1
tcp      6 431970 ESTABLISHED src=10.1.32.57 dst=160.79.148.104 sport=1497
dport=80 src=160.79.148.104 dst=66.9.109.133 sport=80 dport=1497 [ASSURED] use=1
tcp      6 413612 ESTABLISHED src=10.1.32.45 dst=129.81.124.196 sport=1637
dport=6346 src=129.81.124.196 dst=66.9.109.133 sport=6346 dport=1637 [ASSURED]
use=1
tcp      6 59 TIME_WAIT src=10.1.32.45 dst=68.59.170.70 sport=2636 dport=6346
src=68.59.170.70 dst=66.9.109.133 sport=6346 dport=2636 [ASSURED] use=1
tcp      6 55 TIME_WAIT src=10.1.32.57 dst=64.154.81.15 sport=1483 dport=80
src=64.154.81.15 dst=66.9.109.133 sport=80 dport=1483 [ASSURED] use=1
udp      17 145 src=10.1.32.240 dst=10.1.32.5 sport=137 dport=137 src=10.1.32.5
dst=10.1.32.240 sport=137 dport=137 [ASSURED] use=1
tcp      6 107 TIME_WAIT src=10.1.32.57 dst=66.218.75.128 sport=1539 dport=80
src=66.218.75.128 dst=66.9.109.133 sport=80 dport=1539 [ASSURED] use=1
tcp      6 7 SYN_SENT src=10.1.32.45 dst=68.119.213.41 sport=2596 dport=6346
[UNREPLIED] src=68.119.213.41 dst=66.9.109.133 sport=6346 dport=2596 use=1
tcp      6 396354 ESTABLISHED src=10.1.32.241 dst=10.1.32.101 sport=4247
dport=5900 src=10.1.32.101 dst=10.1.32.241 sport=5900 dport=4247 [ASSURED] use=1
tcp      6 431880 ESTABLISHED src=10.1.32.5 dst=10.1.64.2 sport=2031 dport=445
src=10.1.64.2 dst=10.1.32.5 sport=445 dport=2031 [ASSURED] use=1
udp      17 27 src=10.1.32.45 dst=172.194.230.119 sport=3580 dport=6348
[UNREPLIED] src=172.194.230.119 dst=66.9.109.133 sport=6348 dport=3580 use=1
tcp      6 399182 ESTABLISHED src=10.1.32.139 dst=10.1.64.2 sport=4032 dport=445
src=10.1.64.2 dst=10.1.32.139 sport=445 dport=4032 [ASSURED] use=1
tcp      6 68 SYN_SENT src=10.1.32.45 dst=80.137.187.253 sport=2637 dport=6346
[UNREPLIED] src=80.137.187.253 dst=66.9.109.133 sport=6346 dport=2637 use=1
tcp      6 52 SYN_SENT src=10.1.32.45 dst=204.120.161.115 sport=2627 dport=6346
[UNREPLIED] src=204.120.161.115 dst=66.9.109.133 sport=6346 dport=2627 use=1
tcp      6 1 TIME_WAIT src=10.1.32.45 dst=68.101.173.144 sport=2589 dport=6346
src=68.101.173.144 dst=66.9.109.133 sport=6346 dport=2589 [ASSURED] use=1
tcp      6 54 TIME_WAIT src=10.1.32.57 dst=216.73.86.90 sport=1465 dport=80
src=216.73.86.90 dst=66.9.109.133 sport=80 dport=1465 [ASSURED] use=1
tcp      6 431996 ESTABLISHED src=10.1.32.57 dst=160.79.148.103 sport=1523
dport=80 src=160.79.148.103 dst=66.9.109.133 sport=80 dport=1523 [ASSURED] use=1
tcp      6 431999 ESTABLISHED src=10.1.32.45 dst=24.25.239.149 sport=2667
dport=6347 src=24.25.239.149 dst=66.9.109.133 sport=6347 dport=2667 [ASSURED]
use=1
tcp      6 103 FIN_WAIT src=10.1.32.5 dst=160.79.6.130 sport=3357 dport=53
src=160.79.6.130 dst=66.9.109.133 sport=53 dport=3357 [ASSURED] use=1
tcp      6 431990 ESTABLISHED src=10.1.32.57 dst=160.79.148.103 sport=1500
dport=80 src=160.79.148.103 dst=66.9.109.133 sport=80 dport=1500 [ASSURED] use=1

Tom Eastep

2003-Mar-18 19:11 UTC

head link

[Shorewall-users] Bizzare Networking problem

On Tue, 18 Mar 2003, Aaron Held wrote:
> I thought maybe someone had some suggestions as to where to look, but 
> here is the status dump.
> 
> Thanks for your help
> 
> -Aaron Held
> 
> Tom Eastep wrote:
> 
> >On Tue, 18 Mar 2003, Aaron Held wrote:
> >
> >  
> >
> >>Everybody can ping, they just cannot open a tcp socket to one
webserver
> >>in the DMZ.  They can talk to the email server sitting right next
to it
> >>though.
> >>
> >>    
> >>
> >
> >Please post the output of "shorewall status" as an attachment
as described
> >at http://www.shorewall.net/support.htm.
> >
Ok -- let''s review what you have given us so far:
> DMZ = 10.1.64.xx
> Loc = 10.1.32.xx
> 10.1.32.0/24 dev eth1  proto kernel  scope link  src 10.1.32.1
> 10.1.64.0/24 dev eth2  proto kernel  scope link  src 10.1.64.1
Ok -- from this we conclude that eth1 is your local zone and eth2 is your 
DMZ (and give that eth0 has a non-RFC 1918 ip address, we''ll presume
that
that interface is to the internet).

Now you say that "[the local systems] just cannot open a tcp socket to one
webserver in the DMZ.  They can talk to the email server sitting right
next to it though.
>From your "shorewall status" output:---------------------------------------------------------
Chain eth1_fwd (1 references)
 pkts bytes target     prot opt in     out     source               estination
 306K   95M dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0
 128K   60M loc2net    all  --  *      eth0    10.1.32.0/24         0.0.0.0/0
 5243  487K loc2net    all  --  *      eth0    0.0.0.0/0            0.0.0.0/0
    0     0 loc2loc    all  --  *      eth1    10.1.32.0/24         10.1.32.0/24
    8   708 loc2loc    all  --  *      ppp+    10.1.32.0/24         10.1.32.0/24
    0     0 loc2loc    all  --  *      eth1    10.1.32.0/24         0.0.0.0/0
    0     0 loc2loc    all  --  *      eth1    0.0.0.0/0            10.1.32.0/24
    0     0 loc2loc    all  --  *      ppp+    0.0.0.0/0            10.1.32.0/24
   12  1152 loc2loc    all  --  *      eth1    0.0.0.0/0            0.0.0.0/0
 172K   34M loc2dmz    all  --  *      eth2    10.1.32.0/24         0.0.0.0/0
    0     0 loc2dmz    all  --  *      eth2    0.0.0.0/0            0.0.0.0/0
---------------------------------------------------------
>From this it appears that you have mis-used the /etc/shorewall/hosts file. You have eth1 associated with the loc zone in /etc/shorewall/interfaces 
yet you also have an entry in the hosts file associating eth1:10.1.32.0/24 
with the loc zone. Same with ppp+.

Nevertheless, all traffic from eth1->eth2 is passing through the loc2dmz
chain so lets look at that:

---------------------------------------------------------
Chain loc2dmz (3 references)
 pkts bytes target     prot opt in     out     source               
destination         
 171K   34M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0   
state RELATED,ESTABLISHED
    1    40 newnotsyn  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW tcp flags:!0x16/0x02
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0   
state NEW tcp dpt:22
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0   
icmp type 8
 1022 46148 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0
---------------------------------------------------------
So your loc->dmz policy seems to be ACCEPT yet you have ACCEPT rules 
loc->dmz for ssh and ping. Silly but not relevant to your problem.

So all traffic loc->dmz has been accepted except for one lonely packet
that went into the ''netnotsyn'' chain. There are a number of
those but
probably not enough to indicate that you have an asymetric routing
situation.

Note that you didn''t follow the instructions in the support
guide in that you didn''t do a "shorewall reset" before trying
the
connection that is failing then capturing the "shorewall status" (I
see
over 171,000 packets here!!! -- that was quite a test :-) ).

Nevertheless, it seems that your firewall isn''t blocking anything from
the
local zone to the DMZ.

I''m afraid you''re going to have to drag out tcpdump or
ethereal to see
what''s going on.

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
Shoreline,     \ http://shorewall.sf.net
Washington USA  \ teastep@shorewall.net

Aaron Held

2003-Mar-19 07:46 UTC

head link

[Shorewall-users] Bizzare Networking problem

Thank you for the excellent review.

I''ll check the packets later today and get back to list if I find 
anything.  I am beginning to suspect that the issue is on the server or 
client side of things. rather then the firewall, but  putting the 
firewall live definately triggered it.

I do not want a policy of DMZ-> local , I recently added that to try to 
fix this problem. (Again against the docs)

Thanks again,
-Aaron Held

Tom Eastep wrote:
>On Tue, 18 Mar 2003, Aaron Held wrote:
>
>  
>
>>I thought maybe someone had some suggestions as to where to look, but 
>>here is the status dump.
>>
>>Thanks for your help
>>
>>-Aaron Held
>>
>>Tom Eastep wrote:
>>
>>    
>>
>>>On Tue, 18 Mar 2003, Aaron Held wrote:
>>>
>>> 
>>>
>>>      
>>>
>>>>Everybody can ping, they just cannot open a tcp socket to one
webserver
>>>>in the DMZ.  They can talk to the email server sitting right
next to it
>>>>though.
>>>>
>>>>   
>>>>
>>>>        
>>>>
>>>Please post the output of "shorewall status" as an
attachment as described
>>>at http://www.shorewall.net/support.htm.
>>>
>>>      
>>>
>
>Ok -- let''s review what you have given us so far:
>
>  
>
>>DMZ = 10.1.64.xx
>>Loc = 10.1.32.xx
>>    
>>
>
>  
>
>>10.1.32.0/24 dev eth1  proto kernel  scope link  src 10.1.32.1
>>10.1.64.0/24 dev eth2  proto kernel  scope link  src 10.1.64.1
>>    
>>
>
>Ok -- from this we conclude that eth1 is your local zone and eth2 is your 
>DMZ (and give that eth0 has a non-RFC 1918 ip address, we''ll
presume that
>that interface is to the internet).
>
>Now you say that "[the local systems] just cannot open a tcp socket to
one
>webserver in the DMZ.  They can talk to the email server sitting right
>next to it though.
>
>From your "shorewall status" output:
>---------------------------------------------------------
>Chain eth1_fwd (1 references)
> pkts bytes target     prot opt in     out     source              
estination
> 306K   95M dynamic    all  --  *      *       0.0.0.0/0           
0.0.0.0/0
> 128K   60M loc2net    all  --  *      eth0    10.1.32.0/24        
0.0.0.0/0
> 5243  487K loc2net    all  --  *      eth0    0.0.0.0/0           
0.0.0.0/0
>    0     0 loc2loc    all  --  *      eth1    10.1.32.0/24        
10.1.32.0/24
>    8   708 loc2loc    all  --  *      ppp+    10.1.32.0/24        
10.1.32.0/24
>    0     0 loc2loc    all  --  *      eth1    10.1.32.0/24        
0.0.0.0/0
>    0     0 loc2loc    all  --  *      eth1    0.0.0.0/0           
10.1.32.0/24
>    0     0 loc2loc    all  --  *      ppp+    0.0.0.0/0           
10.1.32.0/24
>   12  1152 loc2loc    all  --  *      eth1    0.0.0.0/0           
0.0.0.0/0
> 172K   34M loc2dmz    all  --  *      eth2    10.1.32.0/24        
0.0.0.0/0
>    0     0 loc2dmz    all  --  *      eth2    0.0.0.0/0           
0.0.0.0/0
>---------------------------------------------------------
>
>From this it appears that you have mis-used the /etc/shorewall/hosts file. 
>You have eth1 associated with the loc zone in /etc/shorewall/interfaces 
>yet you also have an entry in the hosts file associating eth1:10.1.32.0/24 
>with the loc zone. Same with ppp+.
>
>Nevertheless, all traffic from eth1->eth2 is passing through the loc2dmz
>chain so lets look at that:
>
>---------------------------------------------------------
>Chain loc2dmz (3 references)
> pkts bytes target     prot opt in     out     source               
>destination         
> 171K   34M ACCEPT     all  --  *      *       0.0.0.0/0           
0.0.0.0/0          state RELATED,ESTABLISHED
>    1    40 newnotsyn  tcp  --  *      *       0.0.0.0/0           
0.0.0.0/0          state NEW tcp flags:!0x16/0x02
>    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0           
0.0.0.0/0          state NEW tcp dpt:22
>    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0           
0.0.0.0/0          icmp type 8
> 1022 46148 ACCEPT     all  --  *      *       0.0.0.0/0           
0.0.0.0/0
>---------------------------------------------------------
>So your loc->dmz policy seems to be ACCEPT yet you have ACCEPT rules 
>loc->dmz for ssh and ping. Silly but not relevant to your problem.
>
>So all traffic loc->dmz has been accepted except for one lonely packet
>that went into the ''netnotsyn'' chain. There are a number
of those but
>probably not enough to indicate that you have an asymetric routing
>situation.
>
>Note that you didn''t follow the instructions in the support
>guide in that you didn''t do a "shorewall reset" before
trying the
>connection that is failing then capturing the "shorewall status"
(I see
>over 171,000 packets here!!! -- that was quite a test :-) ).
>
>Nevertheless, it seems that your firewall isn''t blocking anything
from the
>local zone to the DMZ.
>
>I''m afraid you''re going to have to drag out tcpdump or
ethereal to see
>what''s going on.
>
>-Tom
>  
>

Aaron Held

2003-Mar-20 08:11 UTC

head link

[Shorewall-users] Bizzare Networking problem

I noticed that the clients that cannot conecct are trying to neotiate a 
key exchange.  But I do not know why some clients are doing this.
This is a trace of both clients running

telnet 10.1.64.2 80

10.1.32.139 can connect
10.1.32.38 cannot

linuxfirewall(266) everything # tethereal  host 10.1.64.2 and host 
10.1.32.38 -i eth1
Capturing on eth1
  0.000000   10.1.32.38 -> 10.1.64.2    TCP 1683 > www [SYN] 
Seq=1971151845 Ack=0 Win=16384 Len=0
  0.001184    10.1.64.2 -> 10.1.32.38   ISAKMP Identity Protection (Main 
Mode)
  0.003623   10.1.32.38 -> 10.1.64.2    ISAKMP Informational
  2.973437   10.1.32.38 -> 10.1.64.2    TCP 1683 > www [SYN] 
Seq=1971151845 Ack=0 Win=16384 Len=0
  8.992462   10.1.32.38 -> 10.1.64.2    TCP 1683 > www [SYN] 
Seq=1971151845 Ack=0 Win=16384 Len=0
linuxfirewall(266) everything # tethereal  host 10.1.64.2 and host 
10.1.32.139 -i eth1
Capturing on eth1
  0.000000  10.1.32.139 -> 10.1.64.2    TCP 3819 > www [SYN] 
Seq=387395454 Ack=0 Win=64240 Len=0
  0.000418    10.1.64.2 -> 10.1.32.139  TCP www > 3819 [SYN, ACK] 
Seq=649389284 Ack=387395455 Win=17520 Len=0
  0.000645  10.1.32.139 -> 10.1.64.2    TCP 3819 > www [ACK] 
Seq=387395455 Ack=649389285 Win=64240 Len=0
  1.610779  10.1.32.139 -> 10.1.64.2    HTTP Continuation

If the policy is to accept traffic in both directions then UDP should be 
allowed and the ISAKMP should succed.

Thanks,
-Aaron Held


Aaron Held wrote:
 Thank you for the excellent review.
>
> I''ll check the packets later today and get back to list if I find 
> anything.  I am beginning to suspect that the issue is on the server 
> or client side of things. rather then the firewall, but  putting the 
> firewall live definately triggered it.
>
> I do not want a policy of DMZ-> local , I recently added that to try 
> to fix this problem. (Again against the docs)
>
> Thanks again,
> -Aaron Held
>
> Tom Eastep wrote:
>
>>On Tue, 18 Mar 2003, Aaron Held wrote:
>>
>>  
>>
>>>I thought maybe someone had some suggestions as to where to look,
but
>>>here is the status dump.
>>>
>>>Thanks for your help
>>>
>>>-Aaron Held
>>>
>>>Tom Eastep wrote:
>>>
>>>    
>>>
>>>>On Tue, 18 Mar 2003, Aaron Held wrote:
>>>>
>>>> 
>>>>
>>>>      
>>>>
>>>>>Everybody can ping, they just cannot open a tcp socket to
one webserver
>>>>>in the DMZ.  They can talk to the email server sitting right
next to it
>>>>>though.
>>>>>
>>>>>   
>>>>>
>>>>>        
>>>>>
>>>>Please post the output of "shorewall status" as an
attachment as described
>>>>at http://www.shorewall.net/support.htm.
>>>>
>>>>      
>>>>
>>
>>Ok -- let''s review what you have given us so far:
>>
>>  
>>
>>>DMZ = 10.1.64.xx
>>>Loc = 10.1.32.xx
>>>    
>>>
>>
>>  
>>
>>>10.1.32.0/24 dev eth1  proto kernel  scope link  src 10.1.32.1
>>>10.1.64.0/24 dev eth2  proto kernel  scope link  src 10.1.64.1
>>>    
>>>
>>
>>Ok -- from this we conclude that eth1 is your local zone and eth2 is
your
>>DMZ (and give that eth0 has a non-RFC 1918 ip address, we''ll
presume that
>>that interface is to the internet).
>>
>>Now you say that "[the local systems] just cannot open a tcp socket
to one
>>webserver in the DMZ.  They can talk to the email server sitting right
>>next to it though.
>>
>>From your "shorewall status" output:
>>---------------------------------------------------------
>>Chain eth1_fwd (1 references)
>> pkts bytes target     prot opt in     out     source              
estination
>> 306K   95M dynamic    all  --  *      *       0.0.0.0/0           
0.0.0.0/0
>> 128K   60M loc2net    all  --  *      eth0    10.1.32.0/24        
0.0.0.0/0
>> 5243  487K loc2net    all  --  *      eth0    0.0.0.0/0           
0.0.0.0/0
>>    0     0 loc2loc    all  --  *      eth1    10.1.32.0/24        
10.1.32.0/24
>>    8   708 loc2loc    all  --  *      ppp+    10.1.32.0/24        
10.1.32.0/24
>>    0     0 loc2loc    all  --  *      eth1    10.1.32.0/24        
0.0.0.0/0
>>    0     0 loc2loc    all  --  *      eth1    0.0.0.0/0           
10.1.32.0/24
>>    0     0 loc2loc    all  --  *      ppp+    0.0.0.0/0           
10.1.32.0/24
>>   12  1152 loc2loc    all  --  *      eth1    0.0.0.0/0           
0.0.0.0/0
>> 172K   34M loc2dmz    all  --  *      eth2    10.1.32.0/24        
0.0.0.0/0
>>    0     0 loc2dmz    all  --  *      eth2    0.0.0.0/0           
0.0.0.0/0
>>---------------------------------------------------------
>>
>>From this it appears that you have mis-used the /etc/shorewall/hosts
file.
>>You have eth1 associated with the loc zone in /etc/shorewall/interfaces 
>>yet you also have an entry in the hosts file associating
eth1:10.1.32.0/24
>>with the loc zone. Same with ppp+.
>>
>>Nevertheless, all traffic from eth1->eth2 is passing through the
loc2dmz
>>chain so lets look at that:
>>
>>---------------------------------------------------------
>>Chain loc2dmz (3 references)
>> pkts bytes target     prot opt in     out     source               
>>destination         
>> 171K   34M ACCEPT     all  --  *      *       0.0.0.0/0           
0.0.0.0/0          state RELATED,ESTABLISHED
>>    1    40 newnotsyn  tcp  --  *      *       0.0.0.0/0           
0.0.0.0/0          state NEW tcp flags:!0x16/0x02
>>    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0           
0.0.0.0/0          state NEW tcp dpt:22
>>    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0           
0.0.0.0/0          icmp type 8
>> 1022 46148 ACCEPT     all  --  *      *       0.0.0.0/0           
0.0.0.0/0
>>---------------------------------------------------------
>>So your loc->dmz policy seems to be ACCEPT yet you have ACCEPT rules 
>>loc->dmz for ssh and ping. Silly but not relevant to your problem.
>>
>>So all traffic loc->dmz has been accepted except for one lonely
packet
>>that went into the ''netnotsyn'' chain. There are a
number of those but
>>probably not enough to indicate that you have an asymetric routing
>>situation.
>>
>>Note that you didn''t follow the instructions in the support
>>guide in that you didn''t do a "shorewall reset"
before trying the
>>connection that is failing then capturing the "shorewall
status" (I see
>>over 171,000 packets here!!! -- that was quite a test :-) ).
>>
>>Nevertheless, it seems that your firewall isn''t blocking
anything from the
>>local zone to the DMZ.
>>
>>I''m afraid you''re going to have to drag out tcpdump or
ethereal to see
>>what''s going on.
>>
>>-Tom
>>  
>>
>

Tom Eastep

2003-Mar-20 08:51 UTC

head link

[Shorewall-users] Bizzare Networking problem

On Thu, 20 Mar 2003, Aaron Held wrote:
> I noticed that the clients that cannot conecct are trying to neotiate a 
> key exchange.  But I do not know why some clients are doing this.
> This is a trace of both clients running
> 
> telnet 10.1.64.2 80
> 
> 10.1.32.139 can connect
> 10.1.32.38 cannot
> 
> linuxfirewall(266) everything # tethereal  host 10.1.64.2 and host 
> 10.1.32.38 -i eth1
> Capturing on eth1
>   0.000000   10.1.32.38 -> 10.1.64.2    TCP 1683 > www [SYN] 
> Seq=1971151845 Ack=0 Win=16384 Len=0
>   0.001184    10.1.64.2 -> 10.1.32.38   ISAKMP Identity Protection (Main
> Mode)
>   0.003623   10.1.32.38 -> 10.1.64.2    ISAKMP Informational
>   2.973437   10.1.32.38 -> 10.1.64.2    TCP 1683 > www [SYN] 
> Seq=1971151845 Ack=0 Win=16384 Len=0
>   8.992462   10.1.32.38 -> 10.1.64.2    TCP 1683 > www [SYN] 
> Seq=1971151845 Ack=0 Win=16384 Len=0
> linuxfirewall(266) everything # tethereal  host 10.1.64.2 and host 
> 10.1.32.139 -i eth1
> Capturing on eth1
>   0.000000  10.1.32.139 -> 10.1.64.2    TCP 3819 > www [SYN] 
> Seq=387395454 Ack=0 Win=64240 Len=0
>   0.000418    10.1.64.2 -> 10.1.32.139  TCP www > 3819 [SYN, ACK] 
> Seq=649389284 Ack=387395455 Win=17520 Len=0
>   0.000645  10.1.32.139 -> 10.1.64.2    TCP 3819 > www [ACK] 
> Seq=387395455 Ack=649389285 Win=64240 Len=0
>   1.610779  10.1.32.139 -> 10.1.64.2    HTTP Continuation
> 
So what do you see on eth2?

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
Shoreline,     \ http://shorewall.sf.net
Washington USA  \ teastep@shorewall.net

Aaron Held

2003-Mar-20 09:02 UTC

head link

[Shorewall-users] Bizzare Networking problem

Here are the eth2 traces:

linuxfirewall(266) root # tcpdump host 10.1.32.139 and host 10.1.64.2 -i 
eth2
tcpdump: listening on eth2
11:45:21.473157 10.1.32.139.1128 > 10.1.64.2.www: S 
2353590856:2353590856(0) win 64240 <mss 1460,nop,nop,sackOK> (DF)
11:45:21.473405 10.1.64.2.www > 10.1.32.139.1128: S 
1666755345:1666755345(0) ack 2353590857 win 17520 <mss 
1460,nop,nop,sackOK> (DF)
11:45:21.473837 10.1.32.139.1128 > 10.1.64.2.www: . ack 1 win 64240 (DF)

3 packets received by filter
0 packets dropped by kernel

linuxfirewall(266) root # tcpdump host 10.1.32.38 and host 10.1.64.2 -i eth2
tcpdump: listening on eth2
11:46:10.745700 10.1.32.38.1780 > 10.1.64.2.www: S 
2943251698:2943251698(0) win 16384 <mss 1406,nop,nop,sackOK> (DF)
11:46:10.746528 10.1.64.2.500 > 10.1.32.38.500: isakmp: phase 1 I ident: 
[|sa]
11:46:10.749166 10.1.32.38.500 > 10.1.64.2.500: isakmp: phase 1 R inf:
    (n: doi=ipsec proto=isakmp type=NO-PROPOSAL-CHOSEN orig=(
        (sa: doi=16842760 situation=50331740)))
11:46:13.735800 10.1.32.38.1780 > 10.1.64.2.www: S 
2943251698:2943251698(0) win 16384 <mss 1406,nop,nop,sackOK> (DF)
11:46:19.754885 10.1.32.38.1780 > 10.1.64.2.www: S 
2943251698:2943251698(0) win 16384 <mss 1406,nop,nop,sackOK> (DF)

5 packets received by filter
0 packets dropped by kernel

I tried editing the common.def to comment out the line that blocks auth, 
but that did not seem to help.

Thanks,
-Aaron Held


Tom Eastep wrote:
>On Thu, 20 Mar 2003, Aaron Held wrote:
>
>  
>
>>I noticed that the clients that cannot conecct are trying to neotiate a 
>>key exchange.  But I do not know why some clients are doing this.
>>This is a trace of both clients running
>>
>>telnet 10.1.64.2 80
>>
>>10.1.32.139 can connect
>>10.1.32.38 cannot
>>
>>linuxfirewall(266) everything # tethereal  host 10.1.64.2 and host 
>>10.1.32.38 -i eth1
>>Capturing on eth1
>>  0.000000   10.1.32.38 -> 10.1.64.2    TCP 1683 > www [SYN] 
>>Seq=1971151845 Ack=0 Win=16384 Len=0
>>  0.001184    10.1.64.2 -> 10.1.32.38   ISAKMP Identity Protection
(Main
>>Mode)
>>  0.003623   10.1.32.38 -> 10.1.64.2    ISAKMP Informational
>>  2.973437   10.1.32.38 -> 10.1.64.2    TCP 1683 > www [SYN] 
>>Seq=1971151845 Ack=0 Win=16384 Len=0
>>  8.992462   10.1.32.38 -> 10.1.64.2    TCP 1683 > www [SYN] 
>>Seq=1971151845 Ack=0 Win=16384 Len=0
>>linuxfirewall(266) everything # tethereal  host 10.1.64.2 and host 
>>10.1.32.139 -i eth1
>>Capturing on eth1
>>  0.000000  10.1.32.139 -> 10.1.64.2    TCP 3819 > www [SYN] 
>>Seq=387395454 Ack=0 Win=64240 Len=0
>>  0.000418    10.1.64.2 -> 10.1.32.139  TCP www > 3819 [SYN, ACK] 
>>Seq=649389284 Ack=387395455 Win=17520 Len=0
>>  0.000645  10.1.32.139 -> 10.1.64.2    TCP 3819 > www [ACK] 
>>Seq=387395455 Ack=649389285 Win=64240 Len=0
>>  1.610779  10.1.32.139 -> 10.1.64.2    HTTP Continuation
>>
>>    
>>
>
>So what do you see on eth2?
>
>-Tom
>  
>

Tom Eastep

2003-Mar-20 09:09 UTC

head link

[Shorewall-users] Bizzare Networking problem

On Thu, 20 Mar 2003, Aaron Held wrote:
> Here are the eth2 traces:
> 
> linuxfirewall(266) root # tcpdump host 10.1.32.139 and host 10.1.64.2 -i 
> eth2
> tcpdump: listening on eth2
> 11:45:21.473157 10.1.32.139.1128 > 10.1.64.2.www: S 
> 2353590856:2353590856(0) win 64240 <mss 1460,nop,nop,sackOK> (DF)
> 11:45:21.473405 10.1.64.2.www > 10.1.32.139.1128: S 
> 1666755345:1666755345(0) ack 2353590857 win 17520 <mss 
> 1460,nop,nop,sackOK> (DF)
> 11:45:21.473837 10.1.32.139.1128 > 10.1.64.2.www: . ack 1 win 64240 (DF)
> 
> 3 packets received by filter
> 0 packets dropped by kernel
> 
> linuxfirewall(266) root # tcpdump host 10.1.32.38 and host 10.1.64.2 -i
eth2
> tcpdump: listening on eth2
> 11:46:10.745700 10.1.32.38.1780 > 10.1.64.2.www: S 
> 2943251698:2943251698(0) win 16384 <mss 1406,nop,nop,sackOK> (DF)
> 11:46:10.746528 10.1.64.2.500 > 10.1.32.38.500: isakmp: phase 1 I ident:
> [|sa]
> 11:46:10.749166 10.1.32.38.500 > 10.1.64.2.500: isakmp: phase 1 R inf:
>     (n: doi=ipsec proto=isakmp type=NO-PROPOSAL-CHOSEN orig=(
>         (sa: doi=16842760 situation=50331740)))
> 11:46:13.735800 10.1.32.38.1780 > 10.1.64.2.www: S 
> 2943251698:2943251698(0) win 16384 <mss 1406,nop,nop,sackOK> (DF)
> 11:46:19.754885 10.1.32.38.1780 > 10.1.64.2.www: S 
> 2943251698:2943251698(0) win 16384 <mss 1406,nop,nop,sackOK> (DF)
> 
> 5 packets received by filter
> 0 packets dropped by kernel
> 
> I tried editing the common.def to comment out the line that blocks auth, 
> but that did not seem to help.
> 
>From that, it is clear that 10.1.64.2 is ignoring 10.1.32.38. There has tobe something you''re not telling us here - why is 10.1.32.38 trying to
establish an IPSEC tunnel to 10.1.64.2? And if traffic between those hosts
is supposed to be tunneled then why isn''t 10.1.32.38 sending the SYN
packet through the tunnel?

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
Shoreline,     \ http://shorewall.sf.net
Washington USA  \ teastep@shorewall.net

Tom Eastep

2003-Mar-20 09:15 UTC

head link

[Shorewall-users] Bizzare Networking problem

On Thu, 20 Mar 2003, Tom Eastep wrote:
> On Thu, 20 Mar 2003, Aaron Held wrote:
> 
> > 
> > I tried editing the common.def to comment out the line that blocks
auth,
> > but that did not seem to help.
> >
Ident/auth seems to have nothing to do with this problem -- we''re not 
seeing any TCP 113 packets!!
 > 
> >From that, it is clear that 10.1.64.2 is ignoring 10.1.32.38. There has
to
> be something you''re not telling us here - why is 10.1.32.38 trying
to
> establish an IPSEC tunnel to 10.1.64.2? And if traffic between those hosts
> is supposed to be tunneled then why isn''t 10.1.32.38 sending the
SYN
> packet through the tunnel?
> 
If you "shorewall clear" can 10.1.32.38 connect to 10.1.64.2?

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
Shoreline,     \ http://shorewall.sf.net
Washington USA  \ teastep@shorewall.net

Aaron Held

2003-Mar-20 09:20 UTC

head link

[Shorewall-users] Bizzare Networking problem

>
>
>From that, it is clear that 10.1.64.2 is ignoring 10.1.32.38. There has to
>be something you''re not telling us here - why is 10.1.32.38 trying
to
>establish an IPSEC tunnel to 10.1.64.2? And if traffic between those hosts
>is supposed to be tunneled then why isn''t 10.1.32.38 sending the
SYN
>packet through the tunnel?
>
>-Tom
>  
>That is the problem, there is no reason that 10.2.32.38 should try to 
setup an IPSEC tunnel, there is no tunnel involved, at least there 
should not be.  Two of the clients are laptops -  (Currently connected 
via ethernet to the LAN).
Maybe they have some route set that pushed this traffic into thier VPN 
connection.

Thanks again,
You are a great help.

-Aaron Held

Aaron Held

2003-Mar-20 09:51 UTC

head link

[Shorewall-users] Bizzare Networking problem - SOLVED!!!

I did not want to try shorewall clear because its in a live setting.

But due to your help I solved the problem.
Both the clients had a netscreen IPSEC client setup that was defaulting 
all connections to use IPSEC. 
The server that they could not connect to had IPSEC setup, but no 
matching settings for these clients, the serves that worked did not have 
any IPSEC at all.

Once I turned off IPSEC on the clients everything worked!

Thanks again for your help, I was so focused on a routing / filtering 
problem that I never checked basic client differences.

-Aaron Held

Tom Eastep wrote:
>On Thu, 20 Mar 2003, Tom Eastep wrote:
>
>  
>
>>On Thu, 20 Mar 2003, Aaron Held wrote:
>>
>>    
>>
>>>I tried editing the common.def to comment out the line that blocks
auth,
>>>but that did not seem to help.
>>>
>>>      
>>>
>
>Ident/auth seems to have nothing to do with this problem -- we''re
not
>seeing any TCP 113 packets!!
> 
>  
>
>>>From that, it is clear that 10.1.64.2 is ignoring 10.1.32.38. There
has to
>>be something you''re not telling us here - why is 10.1.32.38
trying to
>>establish an IPSEC tunnel to 10.1.64.2? And if traffic between those
hosts
>>is supposed to be tunneled then why isn''t 10.1.32.38 sending
the SYN
>>packet through the tunnel?
>>
>>    
>>
>
>If you "shorewall clear" can 10.1.32.38 connect to 10.1.64.2?
>
>-Tom
>  
>

Shorewall users - Mar 2003 - Bizzare Networking problem

[Shorewall-users] Bizzare Networking problem

[Shorewall-users] Bizzare Networking problem

[Shorewall-users] Bizzare Networking problem

[Shorewall-users] Bizzare Networking problem

[Shorewall-users] Bizzare Networking problem

[Shorewall-users] Bizzare Networking problem

[Shorewall-users] Bizzare Networking problem

[Shorewall-users] Bizzare Networking problem

[Shorewall-users] Bizzare Networking problem

[Shorewall-users] Bizzare Networking problem

[Shorewall-users] Bizzare Networking problem

[Shorewall-users] Bizzare Networking problem - SOLVED!!!