Very Computer

Hi there,

I am using natd with the -deny_incoming -log_denied options on our gateway.
Everything works but natd keeps logging messages like:
Oct  7 14:00:28 tele natd[178]: denied [UDP] 212.186.26.203:2301 ->
255.255.255.255:2301
Oct  7 14:00:29 tele natd[178]: denied [TCP] 212.17.70.119:1840 ->
128.130.2.9:1080
Oct  7 14:00:29 tele natd[178]: denied [TCP] 212.17.70.119:1846 ->
128.130.2.9:1080
Oct  7 14:00:29 tele last message repeated 7 times
Oct  7 14:00:31 tele natd[178]: denied [UDP] 195.34.144.175:520 ->
195.34.144.255:520
Oct  7 14:00:35 tele natd[178]: denied [UDP] 212.186.93.126:1747 ->
255.255.255.255:164
Oct  7 14:00:45 tele natd[178]: denied [UDP] 212.186.93.126:1747 ->
255.255.255.255:164
Oct  7 14:00:52 tele natd[178]: denied [UDP] 212.186.26.203:1034 ->
255.255.255.255:2301
Oct  7 14:00:53 tele natd[178]: denied [UDP] 212.17.67.170:520 ->
212.17.67.255:520
The port most often used is 520 (hundreds of them).
Note that none of the target IPs match our own IP.
I am a little bit confused why all those packets are seen by natd as the man
page says for -deny_incoming:

"Reject packets destined for the *current IP number* that have no entry in
the internal translation table."

when i disabled natd and configured ipfw for "deny tcp/ip/udp log from any
to any via ed1",
ipfw did not log anything than requests for our IP.

Is this normal behaviour ?

Thomas

Someone is trying to connect to a SOCKS server.

Quote:> Oct  7 14:00:31 tele natd[178]: denied [UDP] 195.34.144.175:520 ->
> 195.34.144.255:520

This is a router broadcast.

Quote:> Oct  7 14:00:35 tele natd[178]: denied [UDP] 212.186.93.126:1747 ->
> 255.255.255.255:164
> Oct  7 14:00:45 tele natd[178]: denied [UDP] 212.186.93.126:1747 ->
> 255.255.255.255:164

"smip-agent", whatever that is.

Quote:> The port most often used is 520 (hundreds of them).

These are routers that are looking for friends.

Quote:> when i disabled natd and configured ipfw for "deny tcp/ip/udp log from any
> to any via ed1",
> ipfw did not log anything than requests for our IP.

If your configuration is correct most strange packets are coming from the
outside (ed0 perhaps?).

Quote:> Is this normal behaviour ?

Most likely, yes. Drop them with ipfw.

tv