Router firewall entries

[AledJ]

Thanks all.

Mods you can delete this now

[Splash]

Been on Facebook much? (the 3 random outbound addresses I nslookup'd were Facebook hosts)

The inbound ones are indeed most likely scans, don't sweat them too much - if you're connected to the internet then it's going to happen, and is a good reason to not put your machine in a DMZ. As for if the port is open... the screenshot suggests not, but it's probably worth testing with an online portscanner.


Finally I wouldn't worry too much about posting your LAN ip address - it's not going to give anyone access to your machine unless they're on your LAN

[AledJ]

Been on Facebook much? (the 3 random outbound addresses I nslookup'd were Facebook hosts)

The inbound ones are indeed most likely scans, don't sweat them too much - if you're connected to the internet then it's going to happen, and is a good reason to not put your machine in a DMZ. As for if the port is open... the screenshot suggests not, but it's probably worth testing with an online portscanner.


Finally I wouldn't worry too much about posting your LAN ip address - it's not going to give anyone access to your machine unless they're on your LAN

Thanks a lot Splash The outbound ones are my sister- and yeah she is on FB a lot, where as I just check it once a day.

Cheers again.

[Tifosi]

the outbound ones are someone on your network browsing websites... i.e. 69.63.190.22 is facebook

the inbound ones look like scans. You don't really need to hash out your 192 IP's since they're private.

Doesn't your router support NAT & uPnP for the Xbox?

[Splash]

Out of interest why the rules for inbound DNS?

[smargh]

The translation of the logs is: "your sister is doing a lot of facebooking. go to sleep."

If you to post to hexus to query every "hack attack" or warning that your router shows, then you will die of either old age, a heart attack, blood loss from bleeding fingers after 24/7/365 typing, or malnutrition.

http://www.canyouseeme.org/

The "FIN scans" are probably all false positives as a result of you browsing sites and closing lots of TCP connections. Most scans nowadays are straightforward connect attempts.

[oolon]

Ok, why exactly did you redacte all the private ip addresses? a 192.168.0.0/16 address is not addressable from the internet (which is kind of the point of them).

[peterb]

Been pretty much covered - yor NAT firewall is blocking all inbund connections - and passing all outbound one from your private 192.168.xxx.yyy addresses. My guess is that xxx is 0 or 1 (like 95% of all LANS). These are not addressable externally, and are not routable by internet routers.

All ADSL/Internet connections are scanned. I have port 22 open for remote secure login - on a good day I get less than 500 attempts to connect to the server - on a bad day, it can be 50,000 or more. Hence if you DO open any ports (the most common being 80, for http traffic) it is essential that you have other security measures in place to protect the server from malicious attack,and that you pay particular attention to the server application configuration.

But to sum up - sleep easy (apart from wondering exactly what your sister is doing on FB! )