On Saturday 18 November 2017 at 22:37:20, Kevin Wong wrote:
> > Date: Sat, 18 Nov 2017 22:06:31 +0000
> > From: Antony Stone <Antony.Stone@xxxxxxxxxxxxxxxxxxxx>
> > To: squid-users@xxxxxxxxxxxxxxxxxxxxx
> > Subject: Re: Squid Behavior to Ping Destination on
> >
> > Registered Ports
> >
> > Message-ID: <201711182206.31894.Antony.Stone@xxxxxxxxxxxxxxxxxxxx>
> > Content-Type: Text/Plain; charset="iso-8859-15"
> >
> > On Saturday 18 November 2017 at 21:21:38, Kevin Wong wrote:
> > > My firewall (Juniper SRX) caught outbound ICMP flows using vulnerable
> > > ports
> >
> > That makes no sense. ICMP doesn't use port numbers.
>
> That is why I asked the list and was a follow up question if somebody
> replied it is "normal traffic to find the path to the destination or
> proxies in between".
So what does your firewall mean by catching "outbound ICMP flows using
vulnerable ports"?
What exactly is it catching and complaining about?
> > > before initiating outbound HTTP traffic. I am running an updated Squid
> > > Proxy on Ubuntu 16.04. Can anybody explain or confirm the Squid
> > > behavior?
> >
> > What ICMP traffic are you blocking and why?
>
> Besides some basic IDS rules, I'm not blocking ICMP traffic.
Well:
Oct 15 10:46:47 firewall RT_FLOW: RT_FLOW_SESSION_DENY: session
denied 10.1.1.1/1536->91.189.91.26/42518 0x0 icmp 1(8) deny vlan1
uplink UNKNOWN UNKNOWN N/A(N/A) irb.420 UNKNOWN policy deny
certainly looks like blocked ICMP traffic to me.
> What's being blocked are all ports
So, that means UDP and TCP (but not ICMP)
> that are not explicitly allowed outbound. In this case, ports 1024, 1280,
> and 1536 were blocked and 80/tcp, 53/udp are allowed outbound.
Where are those blocked port numbers in your firewall logs?
Antony.
--
Pavlov is in the pub enjoying a pint.
The barman rings for last orders, and Pavlov jumps up exclaiming "Damn! I
forgot to feed the dog!"
Please reply to the list;
please *don't* CC me.
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
