Transition Technology: Ticket #843: 8.8.8.8 (US/United States/google-public-dns-a.google.com) blocked for port scanning

hours, totalhours changed

chris — Tue, 07 Apr 2015 23:24:18 GMT

hours changed from 0.0 to 0.25
totalhours changed from 0.0 to 0.25

Following wiki:PuffinServer#Falsepositives I have unblocked Google's DNS server:

csf -g 8.8.8.8
Chain            num   pkts bytes target     prot opt in     out     source               destination
DENYIN           101    172 20183 DROP       all  --  !lo    *       8.8.8.8              0.0.0.0/0
Temporary Blocks: IP:8.8.8.8 Port: Dir:in TTL:3600 (lfd - *Port Scan* detected from 8.8.8.8 (US/United States/google-public-dns-a.google.com). 20 hits in the last 101 seconds)
csf -dr 8.8.8.8
csf: 8.8.8.8 not found in csf.deny
 csf -g 8.8.8.8
Chain            num   pkts bytes target     prot opt in     out     source               destination
DENYIN           101    173 20211 DROP       all  --  !lo    *       8.8.8.8              0.0.0.0/0
Temporary Blocks: IP:8.8.8.8 Port: Dir:in TTL:3600 (lfd - *Port Scan* detected from 8.8.8.8 (US/United States/google-public-dns-a.google.com). 20 hits in the last 101 seconds)

So that didn't work... tried editing /etc/csf/csf.allow to add:

8.8.8.8 # google.com dns see https://trac.transitionnetwork.org/trac/ticket/843

And restarted:

csf -r

But no joy:

iptables -v -L -n --line-numbers | grep 8.8.8.8
1        0     0 ACCEPT     all  --  !lo    *       8.8.8.8              0.0.0.0/0
1        0     0 ACCEPT     all  --  *      !lo     0.0.0.0/0            8.8.8.8
101      0     0 DROP       all  --  !lo    *       8.8.8.8              0.0.0.0/0
iptables -D INPUT 101
iptables: Index of deletion too big.

I'm at a bit of a loss here, will see if it resolves itself to save spending too much time on this...

chris — Thu, 09 Apr 2015 10:13:02 GMT

The temp block of the Google DNS server was lifted:

iptables -v -L -n --line-numbers | grep 8.8.8.8
1      142 16403 ACCEPT     all  --  !lo    *       8.8.8.8              0.0.0.0/0
1      167 13104 ACCEPT     all  --  *      !lo     0.0.0.0/0            8.8.8.8

 csf -g 8.8.8.8
Chain            num   pkts bytes target     prot opt in     out     source               destination
ALLOWIN          1      142 16403 ACCEPT     all  --  !lo    *       8.8.8.8              0.0.0.0/0
ALLOWOUT         1      167 13104 ACCEPT     all  --  *      !lo     0.0.0.0/0            8.8.8.8

I still have no idea why the Google DNS server tried to connect, multiple times, to port 45 via UDP.

chris — Wed, 15 Apr 2015 13:42:13 GMT

Other people have had issues with CSF/LFD and DNS servers, see https://github.com/omega8cc/boa/issues/685

status changed; resolution set

chris — Thu, 16 Apr 2015 12:28:10 GMT

status changed from new to closed
resolution set to fixed

When we upgrade to the next version of BOA, on ticket:844, then we will get a new, checked, version of csf/lfd from BOA's servers rather than configserver.com, see this diff. In anticipation of that solving this issue I'm closing this ticket.