Portal Home > Knowledgebase > Articles Database > UDP_IN Blocked
UDP_IN Blocked
| Posted by ttgt, 08-05-2014, 10:59 PM |
| Hi,
my user use filezilla to connect my cpanel/csf server,
and his ip be blocked quickly.
i check the /var/log/messages it there is alot logs as the following,
it is because his pc's issue ? or my server config ?
Aug 5 23:22:36 server kernel: [2260752.784600] Firewall: *UDP_IN Blocked* IN=eth1 OUT= MAC=11:22:33:44:55:66:00:d0:22:33:55:00:08:22 SRC=1.1.1.1 DST=2.2.2.2 LEN=140 TOS=0x00 PREC=0x00 TTL=52 ID=0 DF PROTO=UDP SPT=59361 DPT=514 LEN=120
|
| Posted by Srv24x7, 08-06-2014, 02:46 AM |
| Hi,
The FTP connection to the server are usually TCP and not UDP. The issue could be at user or could be at server, but has to be checked to get more information on this.
Is the error message you gave as it is or you have manipulated to hide the IP address?
|
| Posted by NetworkPanda, 08-06-2014, 02:51 AM |
| This has nothing to do with FTP. This a UDP attack and you should block the IPs causing these messages in /var/log/messages (or even better, ban the /24 range from UDP, as in most of these cases the entire network is running botnets).
FTP uses TCP port 21 and not UDP 514 that is displayed above.
Last edited by NetworkPanda; 08-06-2014 at 03:01 AM.
|
| Posted by ttgt, 08-06-2014, 02:54 AM |
| yes,i had modify the two ips.
but it only when user connect his filezilla no matter if he transfering file,
if my csf block it,he could not use my server at all.
|
| Posted by NetworkPanda, 08-06-2014, 02:57 AM |
| Something is wrong with the computer. Run a full virus scan.
Note that FileZilla is a very insecure program, better use WinSCP.
|
| Posted by creativexbits, 08-06-2014, 03:11 AM |
| This may be:
1. Not official FileZilla client
2. User's computer/router/isp has wrong routing rules.
Can user connect to other FTP hosts (from different providers)?
if YES, this is routing problem between host<-client. may be router/isp cause this.
let's test
if you need help. I have free time
|
| Posted by zoid, 08-06-2014, 04:06 AM |
| Most likely a Syslog request.
|
Add to Favourites 
Print this Article
Also Read
Good SSL? (Views: 546)