1

I block most everything with my firewall, what I don't get is why would I constantly receive hits to connect on random ports from port 443.

[iptables] reject_ipv6: IN=eno1 OUT= MAC=...
SRC=2607:f8b0:4005:0805:0000:0000:0000:200e
DST=<one of my IPv6 IPs>
LEN=80 TC=32 HOPLIMIT=120 FLOWLBL=753719 PROTO=TCP
SPT=443 DPT=33820 WINDOW=65535 RES=0x00 ACK SYN URGP=0

As far as I know, I do not own IP address 2607:f8b0:4005:0805:0000:0000:0000:200e so it's not coming from one of my computers.

Is that an attempt to hijack an existing connection that would (by chance) by using port 33820 (a.k.a. the destination port) on my server?

5

It seems your server is connecting to that IPv6 address, which is assigned to Google, on HTTPS and this is the reply from that server, as you can see by the SYN and ACK flag.

My guess would be that your firewall is not allowing established connections initiated from the 'inside' and thus is blocking this traffic.

  • Ah. I added this and it seems to be gone... -A INPUT -i eno1 -p tcp -m state --state ESTABLISHED,RELATED -m tcp -d <myip> ! --syn -j ACCEPT – Alexis Wilke Oct 27 '19 at 9:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.