2

I'd like to understand what the following line means exactly, because similar lines can by found in my system log pretty often and I would not expect any.

[UFW BLOCK] IN=enp2s0 OUT= MAC=72:8a:bd:21:93:eb:00:02:2a:00:6c:c5:08:99 SRC=45.32.243.178 DST=192.168.0.75 LEN=28 TOS=0x00 PREC=0x00 TTL=241 ID=50074 PROTO=UDP SPT=60000 DPT=52346 LEN=8

UFW has the following status, all my ports should be closed:

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

My PC has a local IP (192.168.x.x) and is behind a router facing the public internet that has no rules enabled for NAT, so I suppose all ports are closed and no traffic is supposed reach the local network. I'm not sure I understand that line in the log, but it looks like it blocked a connection from a public IP on the internet to the local IP of my PC. How is this possible, given that my router should not let any traffic in? Is there an explanation, or are there any tests I could run to check my setup? In the past I've had to explicitly open ports (with NAT rules) on my router if I wanted somebody to connect to a service running on my PC, so I'd say I'm pretty sure it should be blocking everything by default now, unless something is very wrong.

  • It is confusing. While NAT is not strictly speaking firewall (it was not built for security), it should still not happen. One possibility is, that your router was compromised. Most cheap routers have notoriously bad security. Other, IMO more likely possibility is, that there is some bug/feature that allowed this. Maybe an outgoing connection opened a port automatically or something like that. Again, NATs are not built for security, they are supposed to be convenient and therefore likely too permissive for serious security application. – Peter Harmann Apr 26 '18 at 21:38
  • 1
    While @PeterHarmann did point to some possible options, I would also point tu uPnP. When enabled, programs on the network can create ephemeral port forwardings. Other than that, the question is unclear: are you talking about a COTS-Router or a real router? What do you mean by NAT rules? Do you have other machines in your network? It's a UDP packet - which can be spoofed. – Tobi Nary Apr 27 '18 at 8:38
2

As your question isn't precise on some points, I'm making a few assumptions here:

  • Your "router" is a COTS router, actually a NATing device, not an actual router.
  • You do have more than one device within the network.
  • You have not configured the COTS router in a specific ways, leaving it at default settings (maybe apart from changing the WiFi password).

There are several possibilities that can lead to this kind of logs and I am partly incorporating comments on the question in this answer.

  • Your router might be compromised and have enabled port forwarding without you being able to see this in the GUI.
  • Another machine in your network might be compromised and sending UDP packets with spoofed IPs.
  • Your machine might be compromised and opened that forward by sending a packet first (yet, this doesn't usually work out of the box for UDP).
  • Your machine (maybe for legitimate reasons like peer to peer networking) may be requesting an ephemeral portforward from the router via uPnP.

Generally speaking, you shouldn't rely on a NAT as a kind of firewall. While it generally provides (some of) the effect, it's not designed for security but for usability. On the other side, you seem to be using a local packet filter - which could be configured more rigiously in regards to outgoing packets - that can help reduce risk significantly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.