Argthtjtr

I finally got around to turning the syslog on for my cablemodem (Motorola Surfboard SBG6580) and I'm seeing about the expected amount of inbound attackage being blocked...

2014-05-30 21:59:02     Local0.Alert    192.168.111.1   May 31 04:58:56 2014 SYSLOG[0]: [Host 192.168.111.1] UDP 12.230.209.198,4500 --> 66.27.xx.xx,61459 DENY:Firewall interface [IP Fragmented Packet] attack

2014-05-30 21:59:02     Local0.Alert    192.168.111.1   May 31 04:58:56 2014 SYSLOG[0]: [Host 192.168.111.1] TCP 17.172.232.109,5223 --> 66.27.xx.xx,53814 DENY:Firewall interface access request

2014-05-30 21:59:02     Local0.Alert    192.168.111.1   May 31 04:58:57 2014 SYSLOG[0]: [Host 192.168.111.1] UDP 12.230.209.198,443 --> 66.27.xx.xx,53385 DENY: Firewall interface [IP Fragmented Packet] attack

2014-05-30 21:59:02     Local0.Alert    192.168.111.1   May 31 04:58:57 2014 SYSLOG[0]: [Host 192.168.111.1] UDP 12.230.209.198,4500 --> 66.27.xx.xx,61459 DENY:Firewall interface [IP Fragmented Packet] attack

2014-05-30 21:59:10     Local0.Alert    192.168.111.1   May 31 04:59:04 2014 SYSLOG[0]: [Host 192.168.111.1] UDP 12.230.209.198,443 --> 66.27.xx.xx,59960 DENY: Firewall interface [IP Fragmented Packet] attack

2014-05-30 21:59:10     Local0.Alert    192.168.111.1   May 31 04:59:04 2014 SYSLOG[0]: [Host 192.168.111.1] UDP 12.230.209.198,4500 --> 66.27.xx.xx,61459 DENY:Firewall interface [IP Fragmented Packet] attack

...and that's great. (Sad, but great.)

But I'm also seeing a HUGE amount of what appears to be denied outbound connectivity:

2014-05-30 16:30:10 Local0.Alert    192.168.111.1   May 30 23:30:04 2014 SYSLOG[0]: [Host 192.168.111.1] TCP 192.168.111.100,58969 --> 38.81.66.127,443 DENY: Inbound or outbound access request 

2014-05-30 16:30:10 Local0.Alert    192.168.111.1   May 30 23:30:04 2014 SYSLOG[0]: [Host 192.168.111.1] TCP 192.168.111.100,58969 --> 38.81.66.127,443 DENY: Inbound or outbound access request 

2014-05-30 16:30:10 Local0.Alert    192.168.111.1   May 30 23:30:04 2014 SYSLOG[0]: [Host 192.168.111.1] TCP 192.168.111.100,58965 --> 162.222.41.13,443 DENY: Inbound or outbound access request 

2014-05-30 16:30:10 Local0.Alert    192.168.111.1   May 30 23:30:04 2014 SYSLOG[0]: [Host 192.168.111.1] TCP 192.168.111.100,58965 --> 162.222.41.13,443 DENY: Inbound or outbound access request 

2014-05-30 16:30:10 Local0.Alert    192.168.111.1   May 30 23:30:04 2014 SYSLOG[0]: [Host 192.168.111.1] TCP 192.168.111.100,58964 --> 38.81.66.179,443 DENY: Inbound or outbound access request 

2014-05-30 16:30:10 Local0.Alert    192.168.111.1   May 30 23:30:04 2014 SYSLOG[0]: [Host 192.168.111.1] TCP 192.168.111.100,58964 --> 38.81.66.179,443 DENY: Inbound or outbound access request 

...and

1. Spot checking suggests that it's all legitimate traffic (Opening connections to CrashPlan, etc.),


2. I have no restrictions configured in the modem; I don't see why it should be blocking anything.

Am I misreading the log entry, and it's not actually being denied? (Seems unlikely.) Is the ISP (TWC) pushing deny tables that are not exposed in the UI? (Tinfoil hat too tight.)

I'm confused. (The good news, such as it is, is that AFAIK I'm not experiencing any actual issues... but maybe I am; tough to tell.)

Thanks.

I googled about motorola modem firewall.. Try to configure or disable the firewall.

If it does NAPT then should still have NAPT there as a protection. If not then if you have another NAPT device you'll have NAPT as protection! (with your OS software firewall and if you have another hardware firewall then you'll have that)

Those inbound attacks would be blocked at that device, by NAPT anyway even without a firewall. (where there's no port forwarding on the ports they attack)

There is a user guide for your device here

http://www.arrisi.com/modems/datasheet/SBG6580/SBG6580_UserGuide.pdf

Perhaps also see if you can telnet or ssh to it and use iptables and configure it that way. one person here mentions iptables and a similar model number device (apparently comcast is apparently ISP that bought motorola modems and use them and this link mentions iptables in the context of an SB6141, though it's not clear from that whether it does use it)

http://forums.comcast.com/t5/Basic-Internet-Connectivity-And/Motorola-SB6141-Not-Receiving-New-Configuration-Boot-File/td-p/1818941

If it does use iptables then run the command iptables -L and see if you see any rules there that might be a culprit.

Further, this post

http://community.callofduty.com/thread/100463756

"Under the firewall settings, by default the only thing checked was IP flood detection and firewall protection. I unchecked both."

You could experiment with checking one and not the other.

It is accessed by local ip of 192.168.0.1 and does DHCP, and even has a firewall, so i'm confidently assuming that if you do ipconfig it'll show you gateway of 192.168.0.1 or whatever the local ip is, so clearly does NAT. So disabling the firewall should be ok. That link above concurs.

http://portforward.com/english/routers/firewalling/Motorola/SBG6580/defaultguide.htm