Subhro wrote:
Could we have a look at the syslof configuration file?

Regards
S.


On Thu, 30 Sep 2004 12:09:40 -0500, Norm Vilmer <[EMAIL PROTECTED]> wrote:


Norm Vilmer wrote:


I have been running a IPFW firewall on FreeBSD 4.10 for a few weeks
now. For some reason a few connection attempts are showing up on the
console rather than going to the log file. I can't seem to figure out
why. Any ideas?

I have tried adding the 'log' key word to every deny statement in my
IPFW firewall config file. For the most part all denied packets are
logged to /var/log/ipfw.log. But about 3-12 per night are not. These
also show up in the security run output email as kernel log messages.




_______________________________________________ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"


More info: my kernel is compiled with these option:

option  TCP_DROP_SYNFIN
option  ICMP_BANDLIM
option  IPFIREWALL
option  IPFIREWALL_VERBOSE
option  IPDIVERT
option  RANDOM_IP_ID



_______________________________________________
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"





I dont think it is a login problem. I made only one change to the syslog.conf file, I added

!ipfw
*.*                             /var/log/ipfw.log

Ok, I did an experiment. I added
${cmd} add 10 pass TCP from any to ${oif}

where oif is my outside/public ip.

Then I attempted an FTP connection to my public ip from
another machine.

This popped up on the console.

Connection attempt to TCP <my public ip>:21 from <my other machine>:3079 flags:0x02

Now I get it <light bulb glowing above my head>, the message on the
console are connection attempts that get through the firewall but no
service is running on the port.

need to look at my rules

_______________________________________________
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to