Hi,
I hope somebody can assist me with this situation that should not happen (FWIW is Revolut).
How can I found the precise line from FORWARDFW chain that triggers this alert?
Jul 30 16:19:43 ipfire kernel: FORWARDFW IN=blue0 OUT=ppp0 MAC=***************** SRC=a.b.c.60 DST=35.201.77.50 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=58499 DF PROTO=TCP SPT=43643 DPT=443 WINDOW=65535 RES=0x00 SYN URGP=0
DST IP: 35.201.77.50
GeoIP (/cgi-bin/ipinfo.cgi?ip=35.201.77.50): country is listed as US
35.201.77.50 []#US) (50.77.201.35.bc.googleusercontent.com) : whois.arin.net
NetRange: 35.192.0.0 - 35.207.255.255
CIDR: 35.192.0.0/12
NetName: GOOGLE-CLOUD
NetHandle: NET-35-192-0-0-1
Parent: NET35 (NET-35-0-0-0-0)
NetType: Direct Allocation
OriginAS:
Organization: Google LLC (GOOGL-2)
US (as country) is not listed in GeoIP filtering, or any range added to any FW Groups does not contain below DST IP… I still get tons of blocks when using Revolut (and Top-Up does not work anymore…)
How can I find what triggers the reject in FORWARDFW chain?
My FORWARDFW chain (-L report), only the LOG lines due to limitation of the characters in one post :
LOG all – anywhere anywhere -m geoip --destination-country GH limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country GI limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country GL limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country GM limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country GN limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country GQ limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country GS limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country GT limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country GU limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country GW limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country GY limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country HK limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country HN limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country HR limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country HT limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country ID limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country IL limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country IM limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country IN limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country IQ limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country IR limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country JE limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country JM limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country JO limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country JP limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country KE limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country KG limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country KH limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country KI limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country KM limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country KN limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country KP limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country KR limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country KW limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country KY limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country KZ limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country LA limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country LB limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country LC limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country LI limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country LK limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country LR limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country LS limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country LT limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country LU limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country LV limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country LY limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country MA limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country MC limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country MD limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country ME limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country MF limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country MG limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country MH limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country MK limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country ML limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country MM limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country MN limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country MO limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country MP limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country MQ limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country MR limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country MS limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country MT limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country MU limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country MV limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country MW limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country MX limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country MY limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country MZ limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country NA limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country NC limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country NE limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country NF limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country NG limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country NI limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country NP limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country NR limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country NU limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country NZ limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country OM limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country PA limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country PE limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country PF limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country PG limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country PH limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country PK limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country PN limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country PR limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country PS limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country PW limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country PY limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country QA limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country RS limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country RU limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country RW limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country SA limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country SB limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country SC limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country SD limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country SG limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country SH limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country SL limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country SM limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country SN limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country SO limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country SR limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country SS limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country ST limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country SV limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country SY limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country SZ limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country TC limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country TD limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country TF limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country TG limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country TH limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country TJ limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country TK limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country TL limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country TM limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country TN limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country TO limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country TR limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country TT limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country TV limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country TW limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country TZ limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country UA limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country UG limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country UY limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country UZ limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country VA limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country VC limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country VE limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country VG limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "
LOG all – anywhere anywhere -m geoip --destination-country VI limit: avg 10/sec burst 20 LOG level warning prefix "FORWARDFW "