Arch Linux

IrvineHimself

Member

From: Scotland

Registered: 2016-08-21

Posts: 275

[Solved] UFW Block showing up in logs?

I have been noticed the following showing up in my logs

Jun 22 05:42:13 mine kernel: [UFW BLOCK] IN=wlp2s0 OUT= MAC=94:65:9c:f6:20:5c:1c:67:58:21:00:94:08:00 SRC=165.231.142.35 DST=192.168.0.100 LEN=95 TOS=0x08 PREC=0x20 TTL=58 ID=55390 DF PROTO=TCP SPT=443 DPT=45186 WINDOW=32686 RES=0x00 ACK PSH URGP=0 

As far as I can figure out, the source is the Nord Vpn server I am currently using, and the destination is my mobile WiFi, 192.168.0.1? Also, the MAC address seems to be my mobile WiFi?

If I run arp-scan 192.168.0.1 I get:

# arp-scan 192.168.0.1
Interface: wlp2s0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.9.5 with 1 hosts (https://github.com/royhills/arp-scan)
192.168.0.1	1c:67:58:21:00:94	HUAWEI TECHNOLOGIES CO.,LTD

1 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.5: 1 hosts scanned in 0.222 seconds (4.50 hosts/sec). 1 responded

Should I be concerned about this?

Irvine

Last edited by IrvineHimself (2019-06-23 05:13:20)

---

Et voilà, elle arrive. La pièce, le sous, peut-être qu'il arrive avec vous!

IrvineHimself

Member

From: Scotland

Registered: 2016-08-21

Posts: 275

Re: [Solved] UFW Block showing up in logs?

After giving this further consideration: At the moment, with a fresh install, I am error hunting my logs and working on a throbber to go with a customised log-in screen. As such I am  frequently rebooting. In view of this, I have come to the conclusion that the Nord server is probably trying to initiate a handshake(?) and, because, after a reboot, I don't have an open connection with the server, the firewall is blocking it. As such the log entries are benign.

So, unless someone has information to the contrary, I will mark this as solved.

Irvine

---

Et voilà, elle arrive. La pièce, le sous, peut-être qu'il arrive avec vous!