topic Deny TCP Reverse Path Check in Network Security

Deny TCP Reverse Path Check

chris unger — Sun, 10 Mar 2019 10:56:20 GMT

I have a pix 506E and I get ~ 20 /sec of the these messages. The message is Deny tcp src outside:xxx.xxx.xxx.xxx/29977 dst inside:yyy.yyy.yyy.yyy/25 by access-group "OUTSIDE_ACCESS_IN"

Where yyy.yyy.yyy.yyy is my webserver. I realize that this means its being blocked, but its becoming a DoS due to the high number. They are comming from many different external IP addresses

Re: Deny TCP Reverse Path Check

gfullage — Mon, 14 Jan 2008 05:57:25 GMT

Syslog message 106023 simply indicates that the firewall has denied a packet based on the src/dest in the syslog itself.

What I would be asking is why are so many different external servers trying to send email (TCP/25) to my web server? Is your web server an email server as well? Is your web server listed with an MX entry in DNS for your domain? If so, why are you not allowing other mail servers to send email to it?

Re: Deny TCP Reverse Path Check

chris unger — Mon, 14 Jan 2008 17:10:32 GMT

Thank you for the response.

My web server is not an email server, our external DNS MX record doesn't point to the webserver. The only traffic allowed by my ACL is port 80.

I feel that we are being attacked, and I have tried tracing the Ip addresses and report them but so far I haven't succeced with any.