Continually getting message in logs:
IPTables Packet Dropped: IN=eth1 OUT= MAC=c4:17:fe:65:51:f8:20:76:00:aa:98:78:08:00
SRC=199.47.216.148 DST=192.168.1.102 LEN=218 TOS=0x00 PREC=0x00 TTL=54 ID=52253 DF #
PROTO=TCP SPT=80 DPT=60684 WINDOW=31 RES=0x00 ACK PSH URGP=0
I did a whois
and know that the source IP 199.47.216.148
has something to do with Dropbox, which I do have installed, but why is it continually trying to connect to me on my 60684 port and clogging up the logs? Dropbox is otherwise working completely fine. It has established connections like
dropbox 2409 myuser 17u IPv4 220578 0t0 TCP 127.0.0.1:37255->127.0.0.1:8080 (CLOSE_WAIT)
dropbox 2409 myuser 23u IPv4 221364 0t0 TCP 127.0.0.1:37273->127.0.0.1:80y80 (CLOSE_WAIT)
dropbox 2409 muser 26u IPv4 221496 0t0 TCP 127.0.0.1:37279->127.0.0.1:8080 (ESTABLISHED)
dropbox 2409 myuser 27u IPv4 216008 0t0 TCP 127.0.0.1:37261->127.0.0.1:8080 (CLOSE_WAIT)
(I should perhaps mention that I have privoxy
and dansguardian
installed too, so only privoxy
is allowed http, https
outbound to port 80
, and only dansguardian
is allowed local outbound to privoxy
which listens on 8118
, and firefox
is then forced to connect to dansguardian
on 127.0.0.1:8080
. This means Dropbox connects through a "proxy" of 127.0.0.1:8080
too, just like firefox does. Not sure this has any relevance but just incase. Pretty much all other standard outbound is allowed. )
My iptables
rules for reference are set to drop and log all inbound connections unless tracked by
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
As I say the strange thing is that Dropbox appears to otherwise work fine, so whatever it wants with this inbound connection must be pretty minor, but it is annoying to continually see it in the logs.