1

I've read many similar answers, but they all dealt with machines that were running publicly accessible services. In my case, I have a (newly installed and fully patched) Ubuntu machine that is used as a file server, with no GUI, web server, or anything else installed.

However, I am getting hundreds of connection attempts every day which are blocked by ufw. The strange thing is, this machine is not accessible from outside - I have a hardware firewall and I don't have any forwarded ports or anything that should even allow external IP addresses to connect to this PC. Here's a sample (I've removed some of the duplicate requests...):

[  785.659880] [UFW BLOCK] IN=ens160 OUT= MAC=00:0c:29:7d:dd:c9:00:1f:12:5c:02:0c:08:00 SRC=68.128.204.97 DST=192.168.1.103 LEN=60 TOS=0x00 PREC=0x00 TTL=49 ID=0 DF PROTO=TCP SPT=443 DPT=42023 WINDOW=28960 RES=0x00 ACK SYN URGP=0 
[ 1162.810808] [UFW BLOCK] IN=ens160 OUT= MAC=00:0c:29:7d:dd:c9:00:1f:12:5c:02:0c:08:00 SRC=104.73.231.80 DST=192.168.1.103 LEN=60 TOS=0x08 PREC=0x40 TTL=51 ID=0 DF PROTO=TCP SPT=443 DPT=40491 WINDOW=28960 RES=0x00 ACK SYN URGP=0 
[ 1212.008102] [UFW BLOCK] IN=ens160 OUT= MAC=00:0c:29:7d:dd:c9:00:1f:12:5c:02:0c:08:00 SRC=173.194.214.188 DST=192.168.1.103 LEN=60 TOS=0x00 PREC=0x00 TTL=45 ID=4599 PROTO=TCP SPT=443 DPT=40711 WINDOW=42780 RES=0x00 ACK SYN URGP=0 
[ 1214.007927] [UFW BLOCK] IN=ens160 OUT= MAC=00:0c:29:7d:dd:c9:00:1f:12:5c:02:0c:08:00 SRC=173.194.214.188 DST=192.168.1.103 LEN=60 TOS=0x00 PREC=0x00 TTL=45 ID=5571 PROTO=TCP SPT=443 DPT=40711 WINDOW=42780 RES=0x00 ACK SYN URGP=0 
...
[ 1226.355604] [UFW BLOCK] IN=ens160 OUT= MAC=00:0c:29:7d:dd:c9:00:1f:12:5c:02:0c:08:00 SRC=65.54.225.168 DST=192.168.1.103 LEN=56 TOS=0x00 PREC=0x00 TTL=43 ID=10430 DF PROTO=TCP SPT=443 DPT=43674 WINDOW=65535 RES=0x00 ACK SYN URGP=0 
[ 1232.364241] [UFW BLOCK] IN=ens160 OUT= MAC=00:0c:29:7d:dd:c9:00:1f:12:5c:02:0c:08:00 SRC=94.31.29.160 DST=192.168.1.103 LEN=60 TOS=0x08 PREC=0x20 TTL=52 ID=0 DF PROTO=TCP SPT=80 DPT=43995 WINDOW=28960 RES=0x00 ACK SYN URGP=0 
[ 1302.304905] [UFW BLOCK] IN=ens160 OUT= MAC=00:0c:29:7d:dd:c9:00:1f:12:5c:02:0c:08:00 SRC=74.125.196.188 DST=192.168.1.103 LEN=52 TOS=0x00 PREC=0x00 TTL=46 ID=3459 PROTO=TCP SPT=5228 DPT=49283 WINDOW=349 RES=0x00 ACK URGP=0 
[ 1302.590812] [UFW BLOCK] IN=ens160 OUT= MAC=00:0c:29:7d:dd:c9:00:1f:12:5c:02:0c:08:00 SRC=74.125.196.188 DST=192.168.1.103 LEN=64 TOS=0x00 PREC=0x00 TTL=46 ID=3660 PROTO=TCP SPT=5228 DPT=49283 WINDOW=349 RES=0x00 ACK URGP=0 
...
[ 1322.776168] [UFW BLOCK] IN=ens160 OUT= MAC=00:0c:29:7d:dd:c9:00:1f:12:5c:02:0c:08:00 SRC=216.68.248.26 DST=192.168.1.103 LEN=64 TOS=0x00 PREC=0x00 TTL=60 ID=60176 PROTO=TCP SPT=443 DPT=49431 WINDOW=255 RES=0x00 ACK URGP=0 

It's weird because my router firewall should definitely be blocking port 80/443, much less 5228 (Google Play Store? No idea what's going on with that.)

What is this traffic and why is it reaching my PC?

  • 4
    It seems like traffic that your computer is initiating; the source port is HTTP[S] 80/443, and the destination port is some ephemeral one (32000+). – Nick T Jul 28 '16 at 5:38
  • Good point, but that just makes the situation weirder, right? I am not browsing the internet (or the Google Play Store!) from this machine...the only services I have installed are samba and SSH. – J. Random User Jul 28 '16 at 21:24
1

It looks like your ufw is missing a rule for accepting ESTABLISHED, RELATED connections. Not sure how that works on ufw, but on plain iptables it is iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

What you are seeing there is that your computer started a connection but then is blocking the response.

  • 2
    Usually you'd want to use iptables -I INPUT in this case rather than iptables -A INPUT to put the rule right at the top of the chain. It's going to be matched a lot so putting it early gives a slight performance improvement, and while it's rare to have REJECT or DROP rules in your rulesets, it's even more rare to need to REJECT or DROP packets that are part of an already established connection. – a CVn Jul 28 '16 at 14:11
  • @MichaelKjörling obviously it must be at the top. In fact, I have that rule right after setting the policies. It really depends on how you load the rules, for example, I use a bash script that reloads everything, so in my case -A is ok because after it, all the specific rules will be appended. And of course, if you use DROP/REJECT you are doing something wrong, unless you set the policies to ACCEPT and then DROP/REJECT everything at the bottom – yzT Jul 28 '16 at 17:52
  • Using DROP/REJECT inside a ruleset doesn't mean "you are doing something wrong". Example case in point: fail2ban. But if OP wants to add the rule to a running system, iptables -I is far better than iptables -A. – a CVn Jul 28 '16 at 18:22
  • It's not clear if I can mix ufw and iptables rules... any idea how to do this safely? (Or do I even want to, since I'm still not sure where the connections are coming from?) – J. Random User Jul 28 '16 at 21:26
  • @J.RandomUser I don't know if you can mix, just search for how to add a rule in ufw. You do are sure where are the connections coming from. You have the IPs in the log. Also it's you the one starting the connection, so if you want to troubleshot what's going on, check what services in your computer are starting the connection to those IPs. – yzT Jul 29 '16 at 7:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.