Spoofed Source Address???

[sgscit]

Hi Guys,

anyone know how to fix this?

19/03/03 09:15 firewalld[98]: deny out eth1 328 udp 20 128 172.153.9.9 255.255.255.255 67 68 (spoofed source address)

Thanks,

Pete


ps:172.153.9.9 is not the real IP

 

[ant2112]

Fix what?

 

[sgscit]

well I know exactly which server the spoofing is coming from, I just don't know how to get rid of it. It is creating traffic to the firewall at about 10 times greater than that of the Internet traffic.

What do I need to change (probably on the server) to stop these messages being produced?

 

[Ntr0P]

The traffic is being generated on the side of your trusted interface. If the trusted interface does not know about that network, it will consider it to be spoofed.

Can I assume this is not really a public IP on your trusted interface?

 

[ant2112]

Tell us a little bit more about the box that is generating all this "spoofed" traffic.

 

[sgscit]

The ip's are valid IP's. The subnet mask is valid.
Both ethernet adaptors on the server or sending out spoofed addresses.

The IP's are registered in DNS on our network, and I can connect via terminal services to the server, ping, nslookup etc

Could it be a routing table issue? I have been trying to set the machine up as a router (without much success)but to try and pinpoint this issue have turned off RRAS.

by public IP do you mean a 10. 172. or 192. IP address?
If so, yes it is one of those. The FB then NAT's it to our Internet IP.

Thanks.

Pete

 

[sgscit]

Ant,

What do you want to know?

 

[Ntr0P]

It sounds like it may be an issue with routing. Do your NICS have more than one IP address assigned to them? If so, are any of the IP addresses the same IP address you are seeing in your logs as a spoofed source address?

 

[sgscit]

The IP addresses are correct, but I don't know why the mask is being changed to 255.255.255.255

The nics only have 1 IP each with a 255.255.255.0 mask.

I turned off RRAS yesterday (it is still off) to see if that would help but it did not stop the spoofing.

thanks.

Pete

 

[Ntr0P]

You said the mask is being changed to a /32. I assume this should be a /24. Also, are both NICs configured with IPs from the same subnet?

Last question (for now), these are static IPs?

 

[sgscit]

IP's are x.x.1.38 & x.x.2.1 on two separate nics. Both are static.

When I do an IPCONFIG /all it displays them correctly, but the firewall displays them as spoofed with a mask of /32

 

[Ntr0P]

OK - so both IPs (x.x.1.38 and x.x.2.1) show as spoofed in the FB logs? Are either the x.x.1 subnet or the x.x.2 subnet, subnets that are defined on the FB trusted interface (probably as secondary networks)?