Tilted Forum Project Discussion Community - View Single Post

cliche · 06-20-2004, 02:26 PM

How's the port forwarding on your router set up? You should make sure it only forwards the necessary incoming ports (traditionally only 80 unless you want games, FTP etc). Sometimes you find people using the 'DMZ' option which can be a worry as it exposes your computer to the full brunt of the internet (so need a good firewall!). It looks from your log that it might be trying to forward these random packets to your computer (if it's 192.168.2.101) - these should ideally be dropped at the router level and not allowed anywhere near your server.

Similarly, check your firewall and make sure it's only allowing incoming connections on the ports you want. I don't know anything about sygate but there should be details in there somewhere.

Lastly, look at the ports you do have open and make sure the servers on those ports are as up to date as possible. I assume, again, you have at least port 80 open through both the router and your firewall - make sure that the apache/IIS/whatever behind it is fully patched.

If all the above is OK, you should be fine. There are plenty of script kiddies out there who'll have a play with a server when it appears - mostly they seem to be looking for vulnerabilities to mess with your computer - either taking advantage of a trojan you happen to have on your computer, or weaknesses in the servers running on the ports you have open (you'll probably see some funny http log entries too)... don't worry, but keep up to date!

06-20-2004, 02:26 PM	#2 (permalink)
cliche Rookie Location: Oxford, UK	How's the port forwarding on your router set up? You should make sure it only forwards the necessary incoming ports (traditionally only 80 unless you want games, FTP etc). Sometimes you find people using the 'DMZ' option which can be a worry as it exposes your computer to the full brunt of the internet (so need a good firewall!). It looks from your log that it might be trying to forward these random packets to your computer (if it's 192.168.2.101) - these should ideally be dropped at the router level and not allowed anywhere near your server. Similarly, check your firewall and make sure it's only allowing incoming connections on the ports you want. I don't know anything about sygate but there should be details in there somewhere. Lastly, look at the ports you do have open and make sure the servers on those ports are as up to date as possible. I assume, again, you have at least port 80 open through both the router and your firewall - make sure that the apache/IIS/whatever behind it is fully patched. If all the above is OK, you should be fine. There are plenty of script kiddies out there who'll have a play with a server when it appears - mostly they seem to be looking for vulnerabilities to mess with your computer - either taking advantage of a trojan you happen to have on your computer, or weaknesses in the servers running on the ports you have open (you'll probably see some funny http log entries too)... don't worry, but keep up to date! __________________ I can't understand why people are frightened of new ideas. I'm frightened of the old ones. -- John Cage (1912 - 1992)