Userbase

Users United
https://userbase.be/forum/

Vreemde security log

https://userbase.be/forum/viewtopic.php?t=29455

Pagina 1 van 1

Vreemde security log

Geplaatst: 09 apr 2011, 02:23
door MClaeys
Sinds enkele dagen heb ik een raar probleem met mijn verbinding.
Mijn Sagem router heeft last van zware speeddrops op regelmatige basis. Verder kan ik wel nog verbinding maken met Xbox live, maar online gamen is niet meer te doen van de lag (wat tot enkele dagen geleden wel nog perfect ging)

Code: Selecteer alles

Time	Event	Event-Type	Details
Apr 9 02:02:25 2011	Outbound Traffic	Blocked - NAT out failed	ICMP type 3 code 1 192.168.1.2->174.36.30.9 on ppp0 [repeated 2 times, last time on Apr 9 02:02:41 2011]
Apr 9 02:02:23 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:1024->174.36.30.9:80 on ppp0
Apr 9 02:01:18 2011	Outbound Traffic	Blocked - NAT out failed	ICMP type 3 code 1 192.168.1.2->174.36.30.9 on ppp0 [repeated 2 times, last time on Apr 9 02:01:40 2011]
Apr 9 02:01:16 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:3248->66.161.11.29:80 on ppp0 [repeated 8 times, last time on Apr 9 02:01:16 2011]
Apr 9 02:00:56 2011	Outbound Traffic	Blocked - NAT out failed	ICMP type 3 code 1 192.168.1.2->174.36.30.9 on ppp0 [repeated 5 times, last time on Apr 9 02:01:07 2011]
Apr 9 01:43:23 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:2343->74.209.160.12:80 on ppp0 [repeated 8 times, last time on Apr 9 01:43:23 2011]
Apr 9 01:21:14 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:1925->74.125.230.136:80 on ppp0
Apr 9 01:20:29 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:2129->64.34.199.74:80 on ppp0 [repeated 6 times, last time on Apr 9 01:20:29 2011]
Apr 9 01:18:54 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:2022->95.101.248.124:443 on ppp0
Apr 9 01:18:54 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:2020->95.101.248.124:443 on ppp0
Apr 9 01:18:54 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:2021->95.101.248.124:443 on ppp0
Apr 9 01:18:51 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:1053->174.36.30.9:80 on ppp0
Apr 9 01:18:42 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:1825->209.85.143.96:80 on ppp0
Apr 9 01:18:40 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:1815->8.12.226.219:80 on ppp0
Apr 9 01:18:39 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:1787->74.125.230.153:80 on ppp0
Apr 9 01:18:39 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:1805->74.125.230.142:80 on ppp0
Apr 9 01:18:39 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:1786->74.125.230.153:80 on ppp0
Apr 9 01:18:39 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:1784->74.125.230.153:80 on ppp0
Apr 9 01:18:39 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:1785->74.125.230.153:80 on ppp0
Apr 9 01:18:35 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:2083->68.67.185.215:80 on ppp0
Apr 9 01:18:35 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:1820->92.123.154.26:80 on ppp0
Apr 9 01:18:35 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:1822->92.123.154.26:80 on ppp0
Apr 9 01:18:35 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:2083->68.67.185.215:80 on ppp0
Apr 9 01:18:35 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:1823->92.123.154.26:80 on ppp0
Apr 9 01:18:34 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:1820->92.123.154.26:80 on ppp0
Apr 9 01:18:34 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:1822->92.123.154.26:80 on ppp0
Apr 9 01:18:34 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:1823->92.123.154.26:80 on ppp0
Apr 9 01:18:34 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:1820->92.123.154.26:80 on ppp0
Apr 9 01:18:34 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:1822->92.123.154.26:80 on ppp0
Apr 9 01:18:34 2011	Outbound Traffic	Blocked - NAT out failed	First packet in connection is not a SYN packet: TCP 192.168.1.2:1823->92.123.154.26:80 on ppp0
Apr 9 01:18:33 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1825->209.85.143.96:80 on ppp0
Apr 9 01:18:31 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1815->8.12.226.219:80 on ppp0
Apr 9 01:18:30 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1787->74.125.230.153:80 on ppp0
Apr 9 01:18:30 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1805->74.125.230.142:80 on ppp0
Apr 9 01:18:30 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1786->74.125.230.153:80 on ppp0
Apr 9 01:18:30 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1784->74.125.230.153:80 on ppp0
Apr 9 01:18:30 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1785->74.125.230.153:80 on ppp0
Apr 9 01:18:27 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1825->209.85.143.96:80 on ppp0
Apr 9 01:18:26 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1815->8.12.226.219:80 on ppp0
Apr 9 01:18:26 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1825->209.85.143.96:80 on ppp0
Apr 9 01:18:26 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1787->74.125.230.153:80 on ppp0
Apr 9 01:18:26 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1805->74.125.230.142:80 on ppp0
Apr 9 01:18:26 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1786->74.125.230.153:80 on ppp0
Apr 9 01:18:26 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1784->74.125.230.153:80 on ppp0
Apr 9 01:18:26 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1785->74.125.230.153:80 on ppp0
Apr 9 01:18:24 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1825->209.85.143.96:80 on ppp0
Apr 9 01:18:24 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1815->8.12.226.219:80 on ppp0
Apr 9 01:18:23 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1825->209.85.143.96:80 on ppp0
Apr 9 01:18:23 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1787->74.125.230.153:80 on ppp0
Apr 9 01:18:23 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1805->74.125.230.142:80 on ppp0
Apr 9 01:18:23 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1786->74.125.230.153:80 on ppp0
Apr 9 01:18:23 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1784->74.125.230.153:80 on ppp0
Apr 9 01:18:23 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1785->74.125.230.153:80 on ppp0
Apr 9 01:18:22 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1815->8.12.226.219:80 on ppp0
Apr 9 01:18:22 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1825->209.85.143.96:80 on ppp0
Apr 9 01:18:22 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1787->74.125.230.153:80 on ppp0
Apr 9 01:18:22 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1805->74.125.230.142:80 on ppp0
Apr 9 01:18:22 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1786->74.125.230.153:80 on ppp0
Apr 9 01:18:22 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1784->74.125.230.153:80 on ppp0
Apr 9 01:18:22 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1785->74.125.230.153:80 on ppp0
Apr 9 01:18:21 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1825->209.85.143.96:80 on ppp0
Apr 9 01:18:21 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1815->8.12.226.219:80 on ppp0
Apr 9 01:18:21 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1825->209.85.143.96:80 on ppp0
Apr 9 01:18:21 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1787->74.125.230.153:80 on ppp0
Apr 9 01:18:21 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1805->74.125.230.142:80 on ppp0
Apr 9 01:18:21 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1786->74.125.230.153:80 on ppp0
Apr 9 01:18:21 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1784->74.125.230.153:80 on ppp0
Apr 9 01:18:21 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1785->74.125.230.153:80 on ppp0
Apr 9 01:18:19 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1815->8.12.226.219:80 on ppp0 [repeated 2 times, last time on Apr 9 01:18:20 2011]
Apr 9 01:18:19 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1787->74.125.230.153:80 on ppp0
Apr 9 01:18:19 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1805->74.125.230.142:80 on ppp0
Apr 9 01:18:19 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1786->74.125.230.153:80 on ppp0
Apr 9 01:18:19 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1784->74.125.230.153:80 on ppp0
Apr 9 01:18:19 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1785->74.125.230.153:80 on ppp0
Apr 9 01:18:19 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1815->8.12.226.219:80 on ppp0
Apr 9 01:18:19 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1787->74.125.230.153:80 on ppp0
Apr 9 01:18:19 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1805->74.125.230.142:80 on ppp0
Apr 9 01:18:19 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1786->74.125.230.153:80 on ppp0
Apr 9 01:18:19 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1784->74.125.230.153:80 on ppp0
Apr 9 01:18:19 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1785->74.125.230.153:80 on ppp0
Apr 9 01:18:18 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1805->74.125.230.142:80 on ppp0
Apr 9 01:18:18 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1787->74.125.230.153:80 on ppp0
Apr 9 01:18:18 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1784->74.125.230.153:80 on ppp0
Apr 9 01:18:18 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1786->74.125.230.153:80 on ppp0
Apr 9 01:18:18 2011	Outbound Traffic	Blocked - NAT out failed	Packet not in tcp window: TCP 192.168.1.2:1785->74.125.230.153:80 on ppp0
Apr 9 01:17:22 2011	Firewall Setup	Firewall internal	Firewall configuration succeeded
Apr 9 01:17:22 2011	Firewall Setup	Firewall internal	No IP for NAT - connections may fail [repeated 2 times, last time on Apr 9 01:17:22 2011]
Apr 9 01:17:21 2011	Firewall Setup	Firewall internal	Starting firewall configuration
Het is duidelijk dat steeds hetzelfde probleem opduikt: Blocked - NAT out failed en No IP for NAT - connections may fail.


Wat ik reeds probeerde:
een factory reset, daarna alle instellingen terug aan gezet zoals ze stonden (wifi beveiligen, telefoon). Dit hielp niet.
DHCP uitgeschakeld op de Sagem (op aanraden van Scarlet, ik had nochtans nergens last van tot voor kort)
DNS 1 en 2 van de Sagem vervangen door 8.8.8.8 en 8.8.4.4 (google dns) omdat deze een pak beter werken


Mijn netwerk ziet er als volgt uit:
------------------------------------------------------------------------
Sagem VDSL2 router: 192.168.1.1
Dhcp aan, range: 192.168.1.2 - 192.168.1.50
Firewall: Typical Security
------------------------------------------------------------------------
Aan deze Sagem zijn 2 toestellen verbonden met de kabel
een Minecraft server (192.168.1.5) en een Linksys WRT320N router (192.168.1.2).
En 2 toestellen draadloos: laptop (192.168.1.3) + gsm (192.168.1.4)

------------------------------------------------------------------------
Linksys WRT320N: 192.168.0.1
Dhcp aan, rande: 192.168.0.2 - 192.168.0.50
Firewall: aan
Filtering anonieme internet verzoeken: uit
Filter Multicast: uit
Filter doorsturen NAT: uit
--------------------------------------------------------------------------
Aan deze linksys zijn wat meer toestellen verbonden.
draadloos: een laptop (192.168.0.3), een Belkin Homebase (192.168.0.4), een PS3 (192.168.0.5)
met kabel: Xbox 360 (192.168.0.50), een tv (192.168.0.6) en een oude desktop waar ik wat op pruts

De Xbox 360 heeft een vast IP vanwege poorten die open moeten staan (heeft nooit problemen gehad)
De Minecraft server heeft omwille van dezelfde reden een vast IP. Al de rest is door DHCP toegekend.
De Linksys router had een vast IP omdat ik hem eens in een DMZ heb gestoken (met de hoop dat het zou helpen, niet dus)

(ik zal eens een grafische voorstelling tekenen als ik wat meer tijd heb, want het is nogal onduidelijk zo.
netwerk.png
(294.67 KiB) Nog niet gedownload
Heeft iemand een idee wat het probleem kan zijn? En vooral hoe ik het oplos.
Iets gelijkaardig/hetzelfde probleem, echter zonder echte oplossing: http://www.walterdevos.be/bbox2-sagem-b ... syn-packet

Re: Vreemde security log

Geplaatst: 11 apr 2011, 23:10
door MClaeys
Morgen komt er een technieker langs die waarschijnlijk gewoon de router gaat vervangen.
Er zijn momenten dat de verbinding toch goed loopt, ze zijn echter zeldzaam. Daarom even een testje gedaan.
Ik heb op mijn WRT320N router DD-WRT firmware op gezet en even gekeken naar de grafiekjes van men verbinding.
Onderstaand resultaat is bij mij de laatste dagen 99% het geval
youtube 1.PNG
Youtube how it shouldn't be
(200.65 KiB) Nog niet gedownload
Maar plots had ik dan toch eens een goede te pakken ook, dit is hoe het zou moeten zijn (nog niet 100%, maar toch), hierboven hoe het niet mag zijn.
youtube 2.PNG
Youtube how it should be
(63.39 KiB) Nog niet gedownload
Beiden getest met enkel Youtube open.

Re: Vreemde security log

Geplaatst: 11 apr 2011, 23:16
door philippe_d
Waarom niet met de Linksys een eigen PPPoE verbinding maken ?
Dan krijgt de WRT320N een publiek IP adres, en kan je hierop alles correct instellen.
Nu heb je een dubbele NAT, en moet zowel de Linksys als de Sagem alles verwerken.

Re: Vreemde security log

Geplaatst: 12 apr 2011, 09:04
door MClaeys
Dat heb ik inderdaad nog niet getest, ik was het topic hierover al wat aan het doorlezen, maar kon niet echt volledig volgen wat de nodige stappen nu zijn (Moet ik PPPoE dan uitschakelen op de Scarlet router? Heeft dit gevolgen voor de telefoonfunctie? ...). Het voordeel is gewoon dat ik nu nog steeds van mijn ene subnet mijn andere kan bereiken, bij een PPPoE op beide routers moet dit via het internet (veronderstel ik), niet handig als ik even wat files doorpomp naar mijn server. Daarentegen, zo vaak doe ik dat doorpompen niet, dus het is misschien de overweging waard.

Verder zitten er ook functies op mijn Linksys die ik niet meteen kan thuisbrengen op scarlet
(Service Name (eender wat?), PPP Compression, T-Home VDSL 7 VLAN Tagging, MPPE Encryption, Multi Link, Force reconnect, STP). Wat de functies doen weet ik wel min of meer (eigen kennis + dd-wrt wiki), in hoeverre ze toepasbaar zijn op Scarlet niet.
Scarlet.PNG
PPPoE settings
(15.7 KiB) 1513 keer gedownload

Re: Vreemde security log

Geplaatst: 12 apr 2011, 09:28
door Sasuke
Dit is een gekende issue met de Sagem routers bij het veelvuldig gebruik van torrents, doe je dat toevallig ?

Re: Vreemde security log

Geplaatst: 12 apr 2011, 09:34
door MClaeys
Nope, ik gebruik geen torrents. Buiten wat downloaden van Youtube, demo's op Xbox en data van de schoolservers (ftp en sftp) komt hier eigenlijk geen/zelden downloadverkeer over de lijn.

Edit: De nieuwe router heeft hetzelfde probleem o.O De technieker zei zelf dat het de brakste routers waren waar hij al mee gewerkt had, de Bbox2 is beter omdat de firmware beter onderhouden word (nuja, dat kon ik zelf ook wel bedenken). Jammer dat die site met firmwares afgesloten is want ik wou er de nieuwste Bbox2 firmware op smijten om te zien of het dan opgelost was.
Alle tijden zijn UTC+02:00
Pagina 1 van 1

Powered by phpBB® Forum Software © phpBB Limited

Nederlandse vertaling door phpBB.nl.