Meu firewall (Juniper SRX) capturou fluxos de saída usando portas vulneráveis que são conhecidas por serem usadas para Trojans, Windows Backdoor e NHL 2013. Uma coisa que parece estranha é que os fluxos estão usando o protocolo ICMP. Isso tem acontecido algumas vezes todos os dias.
Estou executando um proxy atualizado do Squid no Ubuntu 16.04. As atualizações automáticas são desativadas e o firewall com base em host tem um padrão de negação de entrada / saída, com apenas a porta 80 para a saída permitida do IP específico. Antes de pegar meu bastão de baseball, alguém pode explicar ou confirmar o comportamento do Squid? ou o comportamento de segundo plano do Ubuntu relacionado ao tráfego HTTP?
Abaixo está uma cópia das sessões de fluxo para um dia, os IPs foram obscurecidos, exceto os espelhos do Ubuntu (91.189.x.x). Se você corresponder aos timestamps, poderá ver que houve uma sessão negada toda vez que uma sessão permitida foi criada. Eu não estava executando nenhuma atualização ou gerando tráfego HTTP dos hosts neste dia, o que me faz pensar no que o Ubuntu está fazendo em segundo plano.
Endereços IP
8.8.8.8 = Public IP Gateway
10.1.1.1 = Squid Proxy (RFC1918 using source NAT --> 8.8.8.8)
192.168.1.1 = Host
192.168.1.2 = Host
192.168.1.3 = Host
DENIED FLOWS
Oct 15 03:53:37 firewall RT_FLOW: RT_FLOW_SESSION_DENY: session denied 10.1.1.1/1024->91.189.91.23/42518 0x0 icmp 1(8) deny vlan1 uplink UNKNOWN UNKNOWN N/A(N/A) irb.420 UNKNOWN policy deny
Oct 15 08:06:20 firewall RT_FLOW: RT_FLOW_SESSION_DENY: session denied 10.1.1.1/1280->91.189.91.26/42518 0x0 icmp 1(8) deny vlan1 uplink UNKNOWN UNKNOWN N/A(N/A) irb.420 UNKNOWN policy deny
Oct 15 10:46:47 firewall RT_FLOW: RT_FLOW_SESSION_DENY: session denied 10.1.1.1/1536->91.189.91.26/42518 0x0 icmp 1(8) deny vlan1 uplink UNKNOWN UNKNOWN N/A(N/A) irb.420 UNKNOWN policy deny
FLUXOS PERMITIDOS
Oct 15 03:53:37 firewall RT_FLOW: RT_FLOW_SESSION_CREATE: session created 192.168.1.1/60542->10.1.1.1/3128 0x0 None 192.168.1.1/60542->10.1.1.1/3128 0x0 N/A N/A N/A N/A 6 permit-squid vlan2 vlan1 42568 N/A(N/A) irb.888 UNKNOWN UNKNOWN UNKNOWN
Oct 15 03:53:37 firewall RT_FLOW: RT_FLOW_SESSION_CREATE: session created 192.168.1.1/60544->10.1.1.1/3128 0x0 None 192.168.1.1/60544->10.1.1.1/3128 0x0 N/A N/A N/A N/A 6 permit-squid vlan2 vlan1 31115 N/A(N/A) irb.888 UNKNOWN UNKNOWN UNKNOWN
Oct 15 03:53:37 firewall RT_FLOW: RT_FLOW_SESSION_CREATE: session created 10.1.1.1/49848->91.189.91.23/80 0x0 junos-http 8.8.8.8/14971->91.189.91.23/80 0x0 source rule r1 N/A N/A 6 permit-http vlan1 uplink 42939 N/A(N/A) irb.420 UNKNOWN UNKNOWN UNKNOWN
Oct 15 03:53:37 firewall RT_FLOW: RT_FLOW_SESSION_CREATE: session created 10.1.1.1/44144->91.189.88.161/80 0x0 junos-http 8.8.8.8/6230->91.189.88.161/80 0x0 source rule r1 N/A N/A 6 permit-http vlan1 uplink 51879 N/A(N/A) irb.420 UNKNOWN UNKNOWN UNKNOWN
Oct 15 08:06:20 firewall RT_FLOW: RT_FLOW_SESSION_CREATE: session created 192.168.1.2/40484->10.1.1.1/3128 0x0 None 192.168.1.2/40484->10.1.1.1/3128 0x0 N/A N/A N/A N/A 6 permit-squid vlan3 vlan1 2335 N/A(N/A) irb.999 UNKNOWN UNKNOWN UNKNOWN
Oct 15 08:06:20 firewall RT_FLOW: RT_FLOW_SESSION_CREATE: session created 192.168.1.2/40486->10.1.1.1/3128 0x0 None 192.168.1.2/40486->10.1.1.1/3128 0x0 N/A N/A N/A N/A 6 permit-squid vlan3 vlan1 2911 N/A(N/A) irb.999 UNKNOWN UNKNOWN UNKNOWN
Oct 15 08:06:20 firewall RT_FLOW: RT_FLOW_SESSION_CREATE: session created 10.1.1.1/60168->91.189.88.152/80 0x0 junos-http 8.8.8.8/8175->91.189.88.152/80 0x0 source rule r1 N/A N/A 6 permit-http vlan1 uplink 36604 N/A(N/A) irb.420 UNKNOWN UNKNOWN UNKNOWN
Oct 15 08:06:20 firewall RT_FLOW: RT_FLOW_SESSION_CREATE: session created 10.1.1.1/55918->91.189.91.26/80 0x0 junos-http 8.8.8.8/15149->91.189.91.26/80 0x0 source rule r1 N/A N/A 6 permit-http vlan1 uplink 35417 N/A(N/A) irb.420 UNKNOWN UNKNOWN UNKNOWN
Oct 15 10:46:47 firewall RT_FLOW: RT_FLOW_SESSION_CREATE: session created 192.168.1.3/49654->10.1.1.1/3128 0x0 None 192.168.1.3/49654->10.1.1.1/3128 0x0 N/A N/A N/A N/A 6 permit-squid vlan4 vlan1 34295 N/A(N/A) irb.777 UNKNOWN UNKNOWN UNKNOWN
Oct 15 10:46:47 firewall RT_FLOW: RT_FLOW_SESSION_CREATE: session created 192.168.1.3/49656->10.1.1.1/3128 0x0 None 192.168.1.3/49656->10.1.1.1/3128 0x0 N/A N/A N/A N/A 6 permit-squid vlan4 vlan1 27823 N/A(N/A) irb.777 UNKNOWN UNKNOWN UNKNOWN
Oct 15 10:46:47 firewall RT_FLOW: RT_FLOW_SESSION_CREATE: session created 192.168.1.3/49658->10.1.1.1/3128 0x0 None 192.168.1.3/49658->10.1.1.1/3128 0x0 N/A N/A N/A N/A 6 permit-squid vlan4 vlan1 51168 N/A(N/A) irb.777 UNKNOWN UNKNOWN UNKNOWN
Oct 15 10:46:47 firewall RT_FLOW: RT_FLOW_SESSION_CREATE: session created 10.1.1.1/55920->91.189.91.26/80 0x0 junos-http 8.8.8.8/12063->91.189.91.26/80 0x0 source rule r1 N/A N/A 6 permit-http vlan1 uplink 42058 N/A(N/A) irb.420 UNKNOWN UNKNOWN UNKNOWN
Oct 15 10:46:47 firewall RT_FLOW: RT_FLOW_SESSION_CREATE: session created 10.1.1.1/45708->91.189.88.162/80 0x0 junos-http 8.8.8.8/24070->91.189.88.162/80 0x0 source rule r1 N/A N/A 6 permit-http vlan1 uplink 61718 N/A(N/A) irb.420 UNKNOWN UNKNOWN UNKNOWN
Oct 15 10:46:47 firewall RT_FLOW: RT_FLOW_SESSION_CREATE: session created 10.1.1.1/45710->91.189.88.162/80 0x0 junos-http 8.8.8.8/27295->91.189.88.162/80 0x0 source rule r1 N/A N/A 6 permit-http vlan1 uplink 23309 N/A(N/A) irb.420 UNKNOWN UNKNOWN UNKNOWN