<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"><base href="x-msg://147/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Hi Richard.<div><br><div><div>On 19/09/2013, at 3:11 AM, Richard Sidlin <<a href="mailto:richard@sidlin.co.uk">richard@sidlin.co.uk</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div bgcolor="white" lang="EN-GB" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div class="WordSection1" style="page: WordSection1; "><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 10pt; font-family: Verdana, sans-serif; color: rgb(31, 73, 125); ">Thanks Chuck. I certainly don’t want access to port 80 blocked and we received complaints today that it was unavailable. I have Dfix2 installed but I don’t want it blocking access!<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "></div></div></div></blockquote><div><br></div><div>Check /var/log/sec.log ... thats the dfix2 log file. It will tell you exactly which signature caused an IP to be blocked. Once you have the signature name, buzz me and I'll let you know what triggered it in more detail.</div><div><br></div><br><blockquote type="cite"><div bgcolor="white" lang="EN-GB" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div class="WordSection1" style="page: WordSection1; "><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 10pt; font-family: Verdana, sans-serif; color: rgb(31, 73, 125); "> </span></div><div style="border-style: none none none solid; border-left-width: 1.5pt; border-left-color: blue; padding: 0cm 0cm 0cm 4pt; "><div><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(181, 196, 223); padding: 3pt 0cm 0cm; "><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><b><span lang="EN-US" style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span lang="EN-US" style="font-size: 10pt; font-family: Tahoma, sans-serif; "><span class="Apple-converted-space"> </span><a href="mailto:blueonyx-bounces@mail.blueonyx.it" style="color: purple; text-decoration: underline; ">blueonyx-bounces@mail.blueonyx.it</a><span class="Apple-converted-space"> </span>[mailto:blueonyx-<a href="mailto:bounces@mail.blueonyx.it" style="color: purple; text-decoration: underline; ">bounces@mail.blueonyx.it</a>]<span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>Chuck Tetlow<br><b>Sent:</b><span class="Apple-converted-space"> </span>18 September 2013 17:55<br><b>To:</b><span class="Apple-converted-space"> </span>BlueOnyx General Mailing List<br><b>Subject:</b><span class="Apple-converted-space"> </span>[BlueOnyx:13700] Re: Message Log<o:p></o:p></span></div></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">Those log entries show that someone at 195.195.131.183 was trying to connect to 192.168.250.240 on TCP port 80. So they're trying to hit the webpage at the address 192.168.250.240, but were being blocked by the IPTables firewall software on your BX server.<span class="Apple-converted-space"> </span><br><br>Does that source address mean anything to you? What is on that destination IP address, and does that site have a webpage? And probably the most important question - why would the IPTables software be configured to block someone hitting a webpage?? <span class="Apple-converted-space"> </span><br><br>I can't imagine DFix or one of the other automated security tools blocking webpage requests to TCP Port 80, but I don't know all those packages well - so it could be something automatic. But on first guess - I'd suggest someone would have had to manually configure that block. That then goes back to the last question - why would someone want to block access to a webpage/website??<span class="Apple-converted-space"> </span><br><br><br><br>Chuck<span class="Apple-converted-space"> </span><br><br><br><br><b><span style="font-size: 10pt; ">---------- Original Message -----------</span></b><span style="font-size: 10pt; "><span class="Apple-converted-space"> </span><br>From: "Richard Sidlin" <<a href="mailto:richard@sidlin.co.uk" style="color: purple; text-decoration: underline; ">richard@sidlin.co.uk</a>><span class="Apple-converted-space"> </span><br>To: <<a href="mailto:blueonyx@mail.blueonyx.it" style="color: purple; text-decoration: underline; ">blueonyx@mail.blueonyx.it</a>><span class="Apple-converted-space"> </span><br>Sent: Wed, 18 Sep 2013 17:38:09 +0100<span class="Apple-converted-space"> </span><br>Subject: [BlueOnyx:13699] Message Log<br><br>> Hi<span class="Apple-converted-space"> </span><br>> <span class="Apple-converted-space"> </span><br>> I have loads of these in my message log. Anything to be concerned about?<span class="Apple-converted-space"> </span><br>> <span class="Apple-converted-space"> </span><br>> Sep 18 12:30:44 ns5 kernel: IN=eth0 OUT= MAC=00:0a:e4:82:4e:e6:00:90:fb:33:79:96:08:00 SRC=195.195.131.183 DST=192.168.250.240 LEN=60 TOS=0x00 PREC=0x00 TTL=49 ID=32494 DF PROTO=TCP SPT=42963 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0<span class="Apple-converted-space"> </span><br>> Sep 18 12:30:56 ns5 kernel: IN=eth0 OUT= MAC=00:0a:e4:82:4e:e6:00:90:fb:33:79:96:08:00 SRC=195.195.131.182 DST=192.168.250.240 LEN=60 TOS=0x00 PREC=0x00 TTL=49 ID=43175 DF PROTO=TCP SPT=53690 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0<span class="Apple-converted-space"> </span><br>> Sep 18 12:30:56 ns5 kernel: IN=eth0 OUT= MAC=00:0a:e4:82:4e:e6:00:90:fb:33:79:96:08:00 SRC=195.195.131.183 DST=192.168.250.240 LEN=60 TOS=0x00 PREC=0x00 TTL=49 ID=32495 DF PROTO=TCP SPT=42963 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0<span class="Apple-converted-space"> </span><br>> Sep 18 12:31:05 ns5 kernel: IN=eth0 OUT= MAC=00:0a:e4:82:4e:e6:00:90:fb:33:79:96:08:00 SRC=195.195.131.183 DST=192.168.250.240 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=64909 DF PROTO=TCP SPT=48409 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0<span class="Apple-converted-space"> </span><br>> Sep 18 12:31:07 ns5 kernel: IN=eth0 OUT= MAC=00:0a:e4:82:4e:e6:00:90:fb:33:79:96:08:00 SRC=195.195.131.183 DST=192.168.250.240 LEN=60 TOS=0x00 PREC=0x00 TTL=49 ID=48816 DF PROTO=TCP SPT=42656 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0<span class="Apple-converted-space"> </span><br>> Sep 18 12:31:08 ns5 kernel: IN=eth0 OUT= MAC=00:0a:e4:82:4e:e6:00:90:fb:33:79:96:08:00 SRC=195.195.131.183 DST=192.168.250.240 LEN=60 TOS=0x00 PREC=0x00 TTL=49 ID=64910 DF PROTO=TCP SPT=48409 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0<span class="Apple-converted-space"> </span><br>> Sep 18 12:31:12 ns5 kernel: IN=eth0 OUT= MAC=00:0a:e4:82:4e:e6:00:90:fb:33:79:96:08:00 SRC=195.195.131.182 DST=192.168.250.240 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=8668 DF PROTO=TCP SPT=55189 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0<span class="Apple-converted-space"> </span><br>> Sep 18 12:31:14 ns5 kernel: IN=eth0 OUT= MAC=00:0a:e4:82:4e:e6:00:90:fb:33:79:96:08:00 SRC=195.195.131.183 DST=192.168.250.240 LEN=60 TOS=0x00 PREC=0x00 TTL=49 ID=64911 DF PROTO=TCP SPT=48409 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0<span class="Apple-converted-space"> </span><br>> Sep 18 12:31:15 ns5 kernel: IN=eth0 OUT= MAC=00:0a:e4:82:4e:e6:00:90:fb:33:79:96:08:00 SRC=195.195.131.182 DST=192.168.250.240 LEN=60 TOS=0x00 PREC=0x00 TTL=49 ID=8669 DF PROTO=TCP SPT=55189 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0<span class="Apple-converted-space"> </span><br>> <span class="Apple-converted-space"> </span><br>> Thanks<span class="Apple-converted-space"> </span><br>> <span class="Apple-converted-space"> </span><br>> Richard<span class="Apple-converted-space"> </span><br>><span class="Apple-converted-space"> </span></span><span style="font-size: 22.5pt; "> </span><span style="font-size: 10pt; "><br>> <span class="Apple-converted-space"> </span><br><b>------- End of Original Message -------</b></span><o:p></o:p></div></div></div>_______________________________________________<br>Blueonyx mailing list<br><a href="mailto:Blueonyx@mail.blueonyx.it" style="color: purple; text-decoration: underline; ">Blueonyx@mail.blueonyx.it</a><br><a href="http://mail.blueonyx.it/mailman/listinfo/blueonyx" style="color: purple; text-decoration: underline; ">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a></div></blockquote></div><br></div></body></html>