hello, i had cPFence installed for about two weeks with now issues, but it started blocking ports out of no where blocking enhance access to the server
cPFence Blocked: IN=ens18 OUT= MAC=... SRC=104.234.115.229 DST=<redacted> LEN=44 TOS=0x00 PREC=0x60 TTL=60 ID=62710 PROTO=TCP SPT=21415 DPT=8080 WINDOW=1025 RES=0x00 SYN URGP=0
Sep 03 10:41:09 <redacted> srs_milter[980]: CLOSE
Sep 03 10:41:11 <redacted> kernel: cPFence Blocked: IN=ens18 OUT= MAC=... SRC=89.248.163.216 DST=<redacted> LEN=40 TOS=0x00 PREC=0x20 TTL=247 ID=35080 PROTO=TCP SPT=48310 DPT=3135 WINDOW=1024 RES=0x00 SYN URGP=0
Sep 03 10:41:13 <redacted> kernel: cPFence Blocked: IN=ens18 OUT= MAC=... SRC=152.32.153.67 DST=<redacted> LEN=44 TOS=0x00 PREC=0x00 TTL=38 ID=0 DF PROTO=TCP SPT=37533 DPT=16756 WINDOW=1024 RES=0x00 SYN URGP=0
Sep 03 10:41:16 <redacted> kernel: cPFence Blocked: IN=ens18 OUT= MAC=... SRC=89.248.163.48 DST=<redacted> LEN=52 TOS=0x00 PREC=0x20 TTL=56 ID=65127 PROTO=TCP SPT=38262 DPT=8933 WINDOW=65535 RES=0x00 SYN URGP=0
cPFence Blocked: IN=ens18 OUT= MAC=... SRC=<redacted> DST=<redacted> LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=57508 DF PROTO=TCP SPT=47830 DPT=50000 WINDOW=65280 RES=0x00 SYN URGP=0
Sep 03 10:41:29 <redacted> srs_milter[980]: CLOSE
Sep 03 10:41:29 <redacted> kernel: cPFence Blocked: IN=ens18 OUT= MAC=... SRC=<redacted> DST=<redacted> LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=57509 DF PROTO=TCP SPT=47830 DPT=50000 WINDOW=65280 RES=0x00 SYN URGP=0
Sep 03 10:41:30 <redacted> kernel: cPFence Blocked: IN=ens18 OUT= MAC=... SRC=<redacted> DST=<redacted> LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=57510 DF PROTO=TCP SPT=47830 DPT=50000 WINDOW=65280 RES=0x00 SYN URGP=0
Sep 03 10:41:31 <redacted> kernel: cPFence Blocked: IN=ens18 OUT= MAC=... SRC=<redacted> DST=<redacted> LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=57511 DF PROTO=TCP SPT=47830 DPT=50000 WINDOW=65280 RES=0x00 SYN URGP=0
Sep 03 10:41:32 <redacted> kernel: cPFence Blocked: IN=ens18 OUT= MAC=... SRC=<redacted> DST=<redacted> LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=57512 DF PROTO=TCP SPT=47830 DPT=50000 WINDOW=65280 RES=0x00 SYN URGP=0
i had to disable all protection on the test server in order to allow access again
does any one have any idea what happened here ?
