Not sure what this means

Discussion in 'other firewalls' started by stapp, Feb 22, 2007.

Thread Status:
Not open for further replies.
  1. stapp

    stapp Global Moderator

    Joined:
    Jan 12, 2006
    Posts:
    7,291
    Location:
    England
    I am a newcomer to firewalls having just used windows one before.

    When I had a look out of interest at my firewall logs it showed that it was blocking Tiscali, my ISP. (I found this out by putting the numbers in a lookup tool)
    I am able to go online okay, so am I reading this info wrong or is it blocked for doing something else, such as that's where any requests go through?

    Apologies for the basic question
     
  2. Stem

    Stem Firewall Expert

    Joined:
    Oct 5, 2005
    Posts:
    4,948
    Location:
    UK
    What connection type? Dial up/cable?
    What are the firewall log entries? (Are these UDP/TCP, scans/connection attempts, what ports?)

    I ask, as there are a number of possible reasons your firewall could show blocked packets from your ISP. They may be late DNS replies,.... checks to see if you are still active,..... port scanning for abuse (checking for open server ports),.. etc.
     
  3. CReal

    CReal Registered Member

    Joined:
    Feb 17, 2007
    Posts:
    42
    Hi and welcome.From what i understand,you 're a newbie with firewalls.So i presume that you don't know how to understand whether the Tiscali you see are your ISP's servers or not.

    The most likely scenario is that your firewall stopped malicious intrusion or port scan from a PC that simply has the same ISP as you do.It is a common issue with beginners.As soon as they see the name of their ISP,they think that they blocked it by mistake.

    I doubt there is any firewall for newbies out there that would block DNS anyway.
     
  4. Stem

    Stem Firewall Expert

    Joined:
    Oct 5, 2005
    Posts:
    4,948
    Location:
    UK
    Any good SPI firewall will drop late replies from DNS (or any other late UDP replies), unless a rule is in place to allow this inbound.


    stapp,

    The logs (you PM`ed) are showing attempted inbound on the lower reserved ports 135/139/445 from various IP`s. These are common. The firewall is blocking these correctly.
     
  5. stapp

    stapp Global Moderator

    Joined:
    Jan 12, 2006
    Posts:
    7,291
    Location:
    England
    Thank you gentlemen for the replies.

    Also Stem, thanks for a bit more knowledge gained :)
     
Loading...
Thread Status:
Not open for further replies.