78.128.113.62 - - [04/Jan/2020:19:59:33 +0530] "GET /efk-dashboard HTTP/1.1" 404 66914 "-" "python-requests/2.13.0"
There are multiple access records like this even after I have run the commands
ufw deny from 78.128.113.58/24 to any # for ufw
ip route add unreachable 78.128.113 # for fail2ban
I also restarted the fail2ban service after adding the ip.
How to fix this issue? I run out of ideas.
What does this UFW log mean? Has already asked a similar question, but I want to know explicitly what each line of the UFW log means
Feb 6 16:27:08 jonasgroenbek kernel: [71910.873115]
[UFW BLOCK] IN=eth0 OUT=
MAC=a6:8d:e2:51:62:4c:f0:4b:3a:4f:80:30:08:00
SRC=77.72.85.26 DST=157.230.26.180
LEN=40 TOS=0x00 PREC=0x00 TTL=251 ID=62215 PROTO=TCP
SPT=42772 DPT=3194 WINDOW=1024
RES=0x00 SYN URGP=0
For my (and hopefully others) feasibility, I would very much like each individual part being described shortly.
After enabling ufw and the Tiger security auditor, I see warnings saying:
The system accepts ICMP redirection messages
What are ICMP redirection messages? Should they be disabled for security purposes? If so, what is the right way to do that using the ufw firewall?
There are comments in the /etc/rsyslog.d/20-ufw.conf file that give you the option to keep UFW-events from being logged to the kernel and message logs, which i have done.
I would really like to get UFW-events out of the dmesg as well, but how to accomplish that?
I have to open up a group of ports.
Adding the single ports to (g)ufw was easy enough but I can't work out how to open the range 11200-11299.
How do I do that?