Page 1 of 1

Random 10-Net Blocks TCP Ports 143 & 993

Posted: Mon Dec 07, 2015 3:26 pm
by bobnag
Am running Murus Pro 1.3.5 on Mac Mini, OS Server 5 (10.11.1).

In Murus Managed Inbound Services I've allowed All Services for 10-net (as well as 192.168-net, 172.16-net, and 169.254-net). I'm running the Mail service on the Mini, allowed in Murus for Everyone and blocked only for a couple of spammer IPs. Everything's running well, our intranet (10-net) Mail users can all send and receive email on their Macs... but occasionally I see blocked connections in the pffirewall log on ports 143 and 993 from 10-net users, for example:

Dec 7 09:55:15 (NAME_OF_SERVER) pf[328]: 00:00:04.307762 rule 37.murus.inbound.1/0(match): block in on en0: > (SERVER'S_STATIC_IP).993: Flags [FP.], seq 4294967222:37, ack 1, win 4096, options [nop,nop,TS val 790220857 ecr 37403760], length 111

These blocks don't seem to prevent anything and all seems good, but I'm just curious why they appear, since our 10-net is allowed for All Services?

Re: Random 10-Net Blocks TCP Ports 143 & 993

Posted: Tue Dec 08, 2015 1:34 am
by hany
These logs are probably unsolicited acks or connections belonging to expired pf states. As you have already realized, these log records can be ignored. Unchecking the "log all blocked connections" option in Murus' Preferences->General helps reducing the frequency of such logs.