topic Re: firewall connection log in Network Security

firewall connection log

suthomas1 — Mon, 11 Mar 2019 16:37:24 GMT

WOuld need advise on the attached logs from a connection , obtained by tcpdump on a firewall.

46.56.76.34 is the global ip of ours which is been NAT on the device. the private ip for this hosts a website, which is inaccessible.

202.94.66.21 is the internet ip used to check if the site is reachable.

Please suggest what does these logs indicate.

Thanks!

Re: firewall connection log

Herbert Baerten — Mon, 09 Nov 2009 09:00:12 GMT

The capture shows the client (202.94.66.21) sending a TCP SYN, followed by 46.56.76.34 sending a TCP RST.

This means that either the NAT is not configured properly, or the access-list is not permitting the inbound traffic, or the traffic goes through but the server is not listening to port 443.

Check the syslogs, check the same capture on the inside interface, check if you can connect to the server (on its private ip addess) from a client on the inside.

Re: firewall connection log

austin522 — Tue, 10 Nov 2009 14:14:48 GMT

The logs which are attached in the notepad give me a feeling,when connection is intiated from 202.94.66.21 to 46.56.76.34 on port 443 the server which is 46.56.76.34 is replying with a RST packet.so this could be the server is not listening on port 443