Strange reject messages in FW-1 log
DComTalk.com Forum Index DComTalk.com
Discussion of VoIP, VPN, Video Conferencen, DSL and other data commucations.
 
 FAQFAQ   MemberlistMemberlist     RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 
 
Google
 
Web dcomtalk.com
Strange reject messages in FW-1 log

 
Post new topic   Reply to topic    DComTalk.com Forum Index -> Firewalls
Author Message
Guest
Posted: Mon Jan 17, 2005 7:57 pm    Post subject: Strange reject messages in FW-1 log Reply with quote
Hi. Since a couple of days back, we've been getting these weird rejects
4-5 times per hoour in our FW-1 NG FP3 log:

---
Date: 17Jan2005
Time: 12:42:52
Product: VPN-1 & FireWall-1
Interface: daemon
Origin: [my firewall IP]
Type: Log
Action: Reject
Service: smtp
Source: 220.136.172.174
Destination: 168.95.4.211
Protocol: tcp
Rule: 138
Source Port: 4552
Information: resource: https://msa.hinet.net:25/
reason: Content Security - access denied.
dstname: msa.hinet.net
---

Neither the source nor the destination address is on our network.
What is this, and where is it coming from?

/Anders
Back to top
Lars M. Hansen
Guest
Posted: Tue Jan 18, 2005 3:41 am    Post subject: Re: Strange reject messages in FW-1 log Reply with quote
On 17 Jan 2005 06:57:33 -0800, google-groups.20.hennish@spamgourmet.com
spoketh

Quote:
Hi. Since a couple of days back, we've been getting these weird rejects
4-5 times per hoour in our FW-1 NG FP3 log:

---
Date: 17Jan2005
Time: 12:42:52
Product: VPN-1 & FireWall-1
Interface: daemon
Origin: [my firewall IP]
Type: Log
Action: Reject
Service: smtp
Source: 220.136.172.174
Destination: 168.95.4.211
Protocol: tcp
Rule: 138
Source Port: 4552
Information: resource: https://msa.hinet.net:25/
reason: Content Security - access denied.
dstname: msa.hinet.net
---

Neither the source nor the destination address is on our network.
What is this, and where is it coming from?

/Anders

Looks like someone is trying to bounce of your firewall to send e-mail.

Lars M. Hansen
http://www.hansenonline.net
(replace 'badnews' with 'news' in e-mail address)
Back to top
 
Post new topic   Reply to topic    DComTalk.com Forum Index -> Firewalls All times are GMT
Page 1 of 1

 
 You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum




VoIP Solutions: Telephone Systems Electronics Satellite TV Tech & Gadgets
Powered by phpBB