Hallo @marvpp
Dit zijn pogingen van buitenaf om jouw modem binnen te komen, al deze pogingen worden geblokkeerd door de firewall en daar zie je een melding van in de logs. Je hoeft je er verder geen zorgen over te maken.
Dank voor je antwoord @Waqqas . Geval is echter dat de log aangeeft dat er blijkbaar wel een sessie (TCP 80 http) gestart wordt vanuit mijn SRC="MY MODEM ADDRESS" naar een remote DST=103.82.32.17 adres. Dus iemand kan dat toch doen vanuit mijn modem lijkt me. Dit kan je niet van buiten doen. Toch?
@Waqqas volgens mij klopt er toch iets niet. Ik zie nog steeds securitylog regels met daarin GATEWAY en nieuw startende TCP sessie zoals boven staand. Kan het zijn dat "TCP session chaining" of "TCP session forwarding" geconfigureerd is nog voor de Zyxel firewall inspectie doet?
Dit zou niet moeten kunnen. Zie Bullet 2 en 3 van onderstaand. Deze situatie zou impliceren dat sessie in mijn modem dus wel geconfigueerd is om sessie te starten, maar alleen als firewall dit toelaat.
Kan je er nog eens naar kijken?
Add info/GPT antwoord:
It is possible to have a scenario where a TCP session is initiated from an external IP address towards a gateway firewall (such as a Zyxel T-50) and, as part of that session, the next target address is specified. This is often referred to as "TCP session chaining" or "TCP session forwarding."
Here's a simplified description of the process:
-
External IP to Gateway Firewall: An external entity initiates a TCP session towards your gateway firewall (Zyxel T-50). This could be an incoming connection attempting to access a service or application behind the firewall.
-
Firewall Processing: The firewall, being a security device, inspects the incoming traffic based on its rules and policies. If the traffic is allowed, the firewall can then take action based on additional configurations.
-
Next Target Address: As part of the allowed traffic, the firewall can be configured to forward the connection to a specific internal host and port. This effectively means that the initial external session triggers the firewall to start a new session towards the specified internal address and port.
-
Internal Session to Remote Address: The firewall, now acting as a gateway, initiates a new TCP session towards the internal host specified as the next target address. This internal host could be another server, and the communication can continue to an external remote address, such as a web server on TCP port 80.
This type of configuration is commonly used in scenarios where a firewall or gateway is responsible for directing traffic to different internal services based on certain conditions or rules.
It's important to note that such configurations need to be carefully set up and secured to prevent unauthorized access and potential security vulnerabilities. Firewalls often have specific features and settings for handling these types of scenarios, so you should refer to the documentation for your Zyxel T-50 or consult with your network administrator to ensure proper setup and security.
