I've got a NAT box (Ubu 10.04) running ufw with the following sudo ufw status verbose:
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing)
New profiles: skip
To Action From
-- ------ ----
22480/tcp LIMIT IN Anywhere
When I nmap -PN -p 22 192.168.0.0/24 to find all the SSHes running on my NATed (working fine) inside network, I get the following:
Starting Nmap 5.00 ( http://nmap.org ) at 2010-08-16 23:06 EDT
0 ports scanned on 192.168.0.0
Interesting ports on 192.168.0.1:
PORT STATE SERVICE
22/tcp closed ssh
Interesting ports on 192.168.0.2:
PORT STATE SERVICE
22/tcp filtered ssh
Interesting ports on 192.168.0.3:
PORT STATE SERVICE
22/tcp filtered ssh
Interesting ports on 192.168.0.4:
PORT STATE SERVICE
22/tcp filtered ssh
... Continuing for all 254 IPs ...
Note that there are not machines at those other IPs (2, 3, 4, ...).
Why is this UFW rule causing this?? Why should a UFW input rule mess with the ability to nmap out from the router into the internal network? That's not an input, and ufw is set to the default config (except as above) of blocking input ports and not blocking output to ports.
Also, how can I get it to stop logging all the crap that isn't important that it receives? I do want it to log stuff destined to my IP, but not broadcast traffic from Windows machines on the outside (routable) network. The logging of this stuff is really making the logs huge.
