[Resolved] TUN IP going outside. Bad Source Address

sofo

Hi , Few hours ago my hosting provider permanently blocked me saying my server being used for attack spoofing source Ip. They mailed following log from their router.

My server public IP is => 144.66.26.134

But instead of 144.66.26.134 as source IP in their router they can see my openvpn private IPs.

ISP router Log :

> > 15:02:25.905746 d4:3e:7e:d8:bb:ca > 00:26:18:75:ea:90, ethertype IPv4
> > (0x0800), length 60: 172.20.90.2.60293 > 23.15.92.113.443: Flags [R], seq

My open vpn Server Config:

server 172.20.0.0 255.255.0.0

Iptable Command:

iptables -t nat -A POSTROUTING -o eth0  -s 172.20.0.0/16 -j SNAT --to-source 144.66.26.134

All were working fine for last 2 months. But suddenly they kicked me. Sad.
I am still trying to find out the reason what was wrong !!

Can you pls tell me what was the mistake. What could be the reason

Thank you

sofo

Thanks debbie.

I don't have log as they terminated the server. Following is server.conf in details.

They reported that their router log flooded with source IP which is not assigned to my box that is ( 172.20.x.x ) which is my openvpn private IP . I use centos 6.4 with latest openvpn. My client use windows xp/7 machine.
Can you Pls check if it helps.

But I am thinking following line should not let any packet go with source IP 172.20.0.0/16 as public source ip. All should be replaced by - 144.66.26.134 ( server main ip)

iptables -t nat -A POSTROUTING -o eth0  -s 172.20.0.0/16 -j SNAT --to-source 144.66.26.134

But how they can see ip - 172.20.90.2. with my MAC address in their router log !

ISP Router log

> > 15:02:25.905746 d4:3e:7e:d8:bb:ca > 00:26:18:75:ea:90, ethertype IPv4
> > (0x0800), length 60: 172.20.90.2.60293 > 23.15.92.113.443: Flags [R], seq
and many.....with source IP  172.20.90.2 .

local 144.66.26.134

fast-io
port 53
proto udp
dev tun1
dev-node /dev/net/tun1
dev-type tun

ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem

server 172.20.0.0 255.255.0.0 


push "redirect-gateway def1"
push "redirect-gateway def1 bypass-dhcp"

ping 10
ping-exit 60

comp-lzo
persist-key
persist-tun

verb 0
float

script-security 3

cipher none

auth-user-pass-verify /etc/openvpn/auth.sh via-env

client-cert-not-required
username-as-common-name


max-clients 30
status openvpn-status.log
mute 3

link-mtu 1350
reneg-sec 0

sofo

Yes. 172.20.90.2 is one of my clients IP .
I am not sure about my users local network information. May be. Is there any way to prevent it .

Thanks for your suggestion

sofo

Now a days all providerS use VLAN and they say any IP range can be used for VPN clients and it wont conflict with their server LAN . Same applicable with this provider, they confirmed.

Thanks

sofo

Hi,
My server was rented from a dedicated server hosting provider. They terminated my server/Account soon after the issue got noticed.

This looks correct, however, I would remove the "-o eth0" as the source interface could be the TAP/Tun driver.

It's a good suggestion. I will do it as per suggestion.

Thanks

sofo

Why uncommon issues coming only for me . 🙂

TCP 100% usage issue still open . I get that issue every 2-3 days . https://forums.openvpn.net/topic14224.html

Now it is very uncommon TUN adapter IP going outside .

My provider told me if I find the issue and can fixed it they will unlock my server. 🙂
But dont know what to do. I have already consulted with one expert but no luck.

Here is again ISP router LOG.

I run 4 UDP servers in single Centos machine ( 172.20.0.0 , 172.21.0.0 , 172.22.0.0 , 172.23.0.0)

IPS present in LOG here (
172.20.122.162
172.21.174.146
172.22.153.126
172.23.90.2
etc..
)

are the VPN clients ip who are using windows machine.

My IPTABLES command

iptables -t nat -A POSTROUTING -o eth0  -s 172.20.0.0/16 -j SNAT --to-source $SERVER-MAIN-IP1
iptables -t nat -A POSTROUTING -o eth0  -s 172.21.0.0/16 -j SNAT --to-source $SERVER-MAIN-IP2
iptables -t nat -A POSTROUTING -o eth0  -s 172.22.0.0/16 -j SNAT --to-source $SERVER-MAIN-IP3
iptables -t nat -A POSTROUTING -o eth0  -s 172.23.0.0/16 -j SNAT --to-source $SERVER-MAIN-IP4

I think IPTABLES itself not working properly. 🙂

Dear Client,

please check this abuse-case and resolve it. Before we cannot unlock the server.

-----------------%<-----------------
Dear Sir or Madam

We have noticed that you have been using other IPs from the same subnet in
addition to the main IP mentioned in the above subject line.

As this is not permitted, we regret to inform you that your server has been
deactivated.

To unlock the server please mention exact issue happened and the steps you taken.

Yours faithfully

Support Team

15:02:25.885763 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.90.2.60293 > 23.14.92.113.443: Flags [R], seq
192251815, win 0, length 0
15:02:25.905746 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.90.2.60293 > 23.14.92.113.443: Flags [R], seq
192251815, win 0, length 0
15:02:25.942997 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.22.153.126.53271 > 173.194.44.12.80: Flags [R], seq
1774792160, win 0, length 0
15:02:25.943003 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.22.153.126.53271 > 173.194.44.12.80: Flags [R], seq
1774792160, win 0, length 0
15:02:25.952648 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.22.153.126.53271 > 173.194.44.12.80: Flags [R], seq
1774792160, win 0, length 0
15:02:25.961338 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 66: 172.20.122.162.51747 > 173.194.70.103.443: Flags [F.],
seq 346496330, ack 2678213345, win 1433, options [nop,nop,TS val 1023650 ecr
136848072], length 0
15:02:25.973774 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.22.153.126.53271 > 173.194.44.12.80: Flags [R], seq
1774792160, win 0, length 0
15:02:25.982780 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.22.153.126.53271 > 173.194.44.12.80: Flags [R], seq
1774792160, win 0, length 0
15:02:26.003610 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 66: 172.22.142.166.53931 > 173.194.70.103.443: Flags [F.],
seq 3007155454, ack 3919782355, win 1274, options [nop,nop,TS val 15462044
ecr 169539084], length 0
15:02:26.006056 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 66: 172.21.174.146.44205 > 23.14.94.64.80: Flags [F.], seq
2465233686, ack 383659399, win 1326, options [nop,nop,TS val 339193 ecr
2096520029], length 0
15:02:26.008100 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 66: 172.20.143.254.46660 > 173.194.70.95.443: Flags [F.],
seq 483399382, ack 3729010908, win 717, options [nop,nop,TS val 108108 ecr
238081821], length 0
15:02:26.122683 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.22.156.66.59636 > 173.194.44.10.443: Flags [R], seq
3104452216, win 0, length 0
15:02:26.132199 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.90.2.39134 > 92.122.212.99.443: Flags [R], seq
1300184550, win 0, length 0
15:02:26.140244 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.22.156.66.59636 > 173.194.44.10.443: Flags [R], seq
3104452216, win 0, length 0
15:02:26.150314 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.22.156.66.59636 > 173.194.44.10.443: Flags [R], seq
3104452216, win 0, length 0
15:02:26.157444 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.22.156.66.59636 > 173.194.44.10.443: Flags [R], seq
3104452216, win 0, length 0
15:02:26.169217 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 66: 172.21.179.158.37078 > 173.194.44.7.443: Flags [F.], seq
1063418419, ack 740399390, win 5303, options [nop,nop,TS val 1157170 ecr
1165580915], length 0
15:02:26.170799 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 66: 172.23.106.146.50722 > 173.194.70.95.443: Flags [F.],
seq 3242014218, ack 2809166885, win 1029, options [nop,nop,TS val 696960 ecr
207988997], length 0
15:02:26.341960 50:46:5d:a1:94:c8 > 01:00:5e:00:00:01, ethertype IPv4
(0x0800), length 60: 0.0.0.0 > 224.0.0.1: igmp query v2
15:02:26.343386 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.21.175.122.52107 > 123.30.171.254.80: Flags [F.],
seq 3207524999, ack 2777826854, win 1196, length 0
15:02:26.357384 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 66: 172.23.129.30.34829 > 69.171.247.29.80: Flags [F.], seq
3415402042, ack 288689500, win 201, options [nop,nop,TS val 991520 ecr
2301014536], length 0
15:02:26.375310 50:46:5d:a1:95:db > 00:26:88:75:fa:8d, ethertype IPv4
(0x0800), length 60: 10.0.0.99.35145 > 89.108.76.193.80: Flags [F.], seq
1449432621, ack 3457126693, win 1050, length 0
15:02:26.399754 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.30.14.48760 > 192.185.5.146.80: Flags [R], seq
1280593754, win 0, length 0
15:02:26.420082 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.30.14.48760 > 192.185.5.146.80: Flags [R], seq
1280593754, win 0, length 0
15:02:26.422429 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.90.2.39134 > 92.122.212.99.443: Flags [R], seq
1300184550, win 0, length 0
15:02:26.514615 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 66: 172.23.143.138.35358 > 173.194.70.95.443: Flags [F.],
seq 1951808318, ack 3274612466, win 955, options [nop,nop,TS val 86701 ecr
272891121], length 0
15:02:26.648208 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.22.156.66.52593 > 173.194.44.10.443: Flags [R], seq
3683465005, win 0, length 0
15:02:26.648343 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.22.156.66.52593 > 173.194.44.10.443: Flags [R], seq
3683465005, win 0, length 0
15:02:26.648402 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.22.156.66.59636 > 173.194.44.10.443: Flags [R], seq
3104452243, win 0, length 0
15:02:26.655593 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 66: 172.23.181.62.48498 > 173.194.70.95.443: Flags [F.], seq
4095700125, ack 1481679393, win 1115, options [nop,nop,TS val 3626880 ecr
242025485], length 0
15:02:26.695269 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.22.102.222.43535 > 213.163.67.225.80: Flags [R], seq
1064118697, win 0, length 0
15:02:26.804871 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.143.138.42657 > 173.194.44.10.443: Flags [R], seq
698715304, win 0, length 0
15:02:26.813205 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.21.175.122.40157 > 123.30.171.254.80: Flags [F.],
seq 2218336005, ack 3085127337, win 1004, length 0
15:02:26.820094 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 66: 172.22.154.10.47140 > 173.194.44.2.443: Flags [F.], seq
3649064069, ack 1116399931, win 1736, options [nop,nop,TS val 9159328 ecr
1164369093], length 0
15:02:26.895809 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.143.138.42657 > 173.194.44.10.443: Flags [R], seq
698715304, win 0, length 0
15:02:26.904263 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 66: 172.23.126.102.53686 > 23.14.94.26.80: Flags [F.], seq
3108012569, ack 3792491136, win 13035, options [nop,nop,TS val 1092008 ecr
2164679612], length 0
15:02:26.924897 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.143.138.42657 > 173.194.44.10.443: Flags [R], seq
698715304, win 0, length 0
15:02:26.935617 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.143.138.42657 > 173.194.44.10.443: Flags [R], seq
698715304, win 0, length 0
15:02:26.948956 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.22.156.66.52593 > 173.194.44.10.443: Flags [R], seq
3683465005, win 0, length 0
15:02:26.954715 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.143.138.42657 > 173.194.44.10.443: Flags [R], seq
698715304, win 0, length 0
15:02:26.955913 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.22.156.66.52593 > 173.194.44.10.443: Flags [R], seq
3683465005, win 0, length 0
15:02:26.982214 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.143.138.42657 > 173.194.44.10.443: Flags [R], seq
698715304, win 0, length 0
15:02:26.987422 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.143.138.42657 > 173.194.44.10.443: Flags [R], seq
698715304, win 0, length 0
15:02:26.988463 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.22.156.70.44197 > 69.171.247.29.443: Flags [R], seq
2728424629, win 0, length 0
15:02:26.995624 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.143.138.42657 > 173.194.44.10.443: Flags [R], seq
698715304, win 0, length 0
15:02:27.007134 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.143.138.42657 > 173.194.44.10.443: Flags [R], seq
698715304, win 0, length 0
15:02:27.015820 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.143.138.42657 > 173.194.44.10.443: Flags [R], seq
698715304, win 0, length 0
15:02:27.024647 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.143.138.39475 > 173.194.44.10.443: Flags [R], seq
3742053104, win 0, length 0
15:02:27.049837 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.143.138.39475 > 173.194.44.10.443: Flags [R], seq
3742053104, win 0, length 0
15:02:27.055125 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.143.138.39475 > 173.194.44.10.443: Flags [R], seq
3742053104, win 0, length 0
15:02:27.085648 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 66: 172.21.176.58.43694 > 69.171.247.27.443: Flags [R.], seq
1195070417, ack 1553809077, win 285, options [nop,nop,TS val 2537984 ecr
1685611790], length 0
15:02:27.091606 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 66: 172.21.176.58.39821 > 92.122.212.161.80: Flags [F.], seq
2461285937, ack 4081613169, win 1005, options [nop,nop,TS val 2537984 ecr
2165173241], length 0
15:02:27.094144 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.143.138.39475 > 173.194.44.10.443: Flags [R], seq
3742053104, win 0, length 0
15:02:27.105493 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.22.156.70.44197 > 69.171.247.29.443: Flags [R], seq
2728424629, win 0, length 0
15:02:27.108124 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.90.2.47256 > 23.63.99.33.443: Flags [R], seq
497838080, win 0, length 0
15:02:27.132135 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 66: 172.23.121.2.49106 > 117.121.54.219.80: Flags [F.], seq
787894392, ack 3050717488, win 877, options [nop,nop,TS val 647656 ecr
2254535482], length 0
15:02:27.135177 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.143.138.39475 > 173.194.44.10.443: Flags [R], seq
3742053104, win 0, length 0
15:02:27.152882 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.20.214.238.52001 > 93.184.220.40.80: Flags [F.], seq
2422703606, ack 3834103491, win 235, length 0
15:02:27.180579 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 68: 172.20.197.138.58666 > 176.34.178.34.80: Flags [FP.],
seq 2675495793:2675495795, ack 472570705, win 3210, options [nop,nop,TS val
1249393 ecr 1451088275], length 2
15:02:27.194121 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.90.2.47256 > 23.63.99.33.443: Flags [R], seq
497838080, win 0, length 0
15:02:27.194652 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.143.138.39475 > 173.194.44.10.443: Flags [R], seq
3742053104, win 0, length 0
15:02:27.200632 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.22.156.66.52593 > 173.194.44.10.443: Flags [R], seq
3683465005, win 0, length 0
15:02:27.201297 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.22.156.66.52593 > 173.194.44.10.443: Flags [R], seq
3683465005, win 0, length 0
15:02:27.225569 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 66: 172.23.181.62.37307 > 173.194.70.95.443: Flags [F.], seq
3867195760, ack 2592132636, win 1108, options [nop,nop,TS val 3626928 ecr
199657116], length 0
15:02:27.232822 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.90.2.50292 > 92.122.212.106.443: Flags [R], seq
742061584, win 0, length 0
15:02:27.253976 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.90.2.50292 > 92.122.212.106.443: Flags [R], seq
742061584, win 0, length 0
15:02:27.275340 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.22.156.66.52593 > 173.194.44.10.443: Flags [R], seq
3683465032, win 0, length 0
15:02:27.277531 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 66: 172.23.129.30.34830 > 69.171.247.29.80: Flags [F.], seq
3153902235, ack 3382658371, win 201, options [nop,nop,TS val 991616 ecr
1689410516], length 0
15:02:27.487324 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.143.138.39475 > 173.194.44.10.443: Flags [R], seq
3742053104, win 0, length 0
15:02:27.496498 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.143.138.39475 > 173.194.44.10.443: Flags [R], seq
3742053104, win 0, length 0
15:02:27.514198 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.143.138.39475 > 173.194.44.10.443: Flags [R], seq
3742053104, win 0, length 0
15:02:27.524488 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.143.138.39475 > 173.194.44.10.443: Flags [R], seq
3742053104, win 0, length 0
15:02:27.544449 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.143.138.39475 > 173.194.44.10.443: Flags [R], seq
3742053104, win 0, length 0
15:02:27.602460 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.137.62.44729 > 173.194.44.10.80: Flags [R], seq
2875411482, win 0, length 0
15:02:27.607587 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.137.62.44729 > 173.194.44.10.80: Flags [R], seq
2875411482, win 0, length 0
15:02:27.614430 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.21.175.122.33788 > 123.30.171.254.80: Flags [F.],
seq 3881405397, ack 171470646, win 1004, length 0
15:02:27.622056 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.137.62.44729 > 173.194.44.10.80: Flags [R], seq
2875411482, win 0, length 0
15:02:27.636166 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.137.62.44729 > 173.194.44.10.80: Flags [R], seq
2875411482, win 0, length 0
15:02:27.655025 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.137.62.44729 > 173.194.44.10.80: Flags [R], seq
2875411482, win 0, length 0
15:02:27.676012 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.137.62.44729 > 173.194.44.10.80: Flags [R], seq
2875411482, win 0, length 0
15:02:27.821210 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.54.186.42247 > 50.7.220.195.80: Flags [R], seq
489623539, win 0, length 0
15:02:27.826949 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.54.186.42247 > 50.7.220.195.80: Flags [R], seq
489623539, win 0, length 0
15:02:27.840289 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.54.186.42247 > 50.7.220.195.80: Flags [R], seq
489623539, win 0, length 0
15:02:27.869978 d4:3d:7e:d8:bb:ca > 00:26:88:75:fa:90, ethertype IPv4
(0x0800), length 60: 172.23.54.186.42247 > 50.7.220.195.80: Flags [R], seq
489623539, win 0, length 0

Thanks

sofo

Thanks. But It is not a solution. If any other expert can tell about probable root cause.

Thanks

sofo

Hmm..It was indeed iptables SNAT bug with invalid TCP connection where
INVALID connections pass thru NAT without changing source IP instead of dropping them.

Few sources confirmed that.

Solved it using -> -m state --state INVALID -j DROP
Till now all are ok.🙂

Thanks