1

I block most everything with my firewall, what I don't get is why would I constantly receive hits to connect on random ports from port 443.

[iptables] reject_ipv6: IN=eno1 OUT= MAC=...
SRC=2607:f8b0:4005:0805:0000:0000:0000:200e
DST=<one of my IPv6 IPs>
LEN=80 TC=32 HOPLIMIT=120 FLOWLBL=753719 PROTO=TCP
SPT=443 DPT=33820 WINDOW=65535 RES=0x00 ACK SYN URGP=0

As far as I know, I do not own IP address 2607:f8b0:4005:0805:0000:0000:0000:200e so it's not coming from one of my computers.

Is that an attempt to hijack an existing connection that would (by chance) by using port 33820 (a.k.a. the destination port) on my server?

Improve this question

1 Answer 1

Reset to default
5

It seems your server is connecting to that IPv6 address, which is assigned to Google, on HTTPS and this is the reply from that server, as you can see by the SYN and ACK flag.

My guess would be that your firewall is not allowing established connections initiated from the 'inside' and thus is blocking this traffic.

Improve this answer
1
  • Ah. I added this and it seems to be gone... -A INPUT -i eno1 -p tcp -m state --state ESTABLISHED,RELATED -m tcp -d <myip> ! --syn -j ACCEPT
    – Alexis Wilke
    Commented Oct 27, 2019 at 9:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .