(SOLVED) Strange firewall/internet connection issue...

[ardvark71]

Hi all...

The initial discovery of this issue began in ScottyK's thread, "Security for Traveling?" but rather than hijack his thread, I decided to start a new one.

I originally thought this was an issue in iptables, however, as I've discovered, ShieldsUP! reports the same problem while running Windows as well: The port "domain Domain Name Server" is open (red) when it didn't used to be. The rest are "closed" or blue in color. Both iptables and Windows firewall report the same thing. So my question is: I have Qwest DSL and I connect directly to the modem that Qwest issued. Is there some firewall layer the modem or perhaps Qwest is providing on their end that is affecting packets before they reach the firewalls on my computer? I'm not understanding this at all.

I am hoping to get some input from you guys before I call Qwest about it. If both iptables and Windows firewall (and in the past, 3rd party firewalls) report the same thing, I can't see this as being an issue with my system...or is it?

Regards...

[Ole Juul]

Re: Strange firewall/internet connection issue...

I'm no expert, but find the subject interesting. Could it be that Qwest has configured their domain name servers to not respond to anything except a DNS request? No response could be construed as an open port. Do you have an outside accesible local domain name server? I am assuming we're talking about port 53 here.

There are also different ways of scanning. Trying a different service might be enlightening. Anyway, one thing to check is if "your" IP is unique to you or actually exists within the Qwest network. The fact that you get the same response from Windows is suspect to me and I would be inclined to think that the scan is not actually of your computer but of a further away IP. (Such as, or similar to, what I mentioned in the referring thread.)

[ardvark71]

Re: Strange firewall/internet connection issue...

I'm no expert, but find the subject interesting. Could it be that Qwest has configured their domain name servers to not respond to anything except a DNS request? No response could be construed as an open port. Do you have an outside accesible local domain name server? I am assuming we're talking about port 53 here.

There are also different ways of scanning. Trying a different service might be enlightening. Anyway, one thing to check is if "your" IP is unique to you or actually exists within the Qwest network. The fact that you get the same response from Windows is suspect to me and I would be inclined to think that the scan is not actually of your computer but of a further away IP. (Such as, or similar to, what I mentioned in the referring thread.)

Thank you, Ole, for your response!

Ah, you got it, port 53.

I'm also inclined to think it has something to do with Qwest's servers and if so, issue resolved.

Regards...

[Ole Juul]

Re: Strange firewall/internet connection issue...

I am assuming that you are using DHCP to get the numbers from your ISP, but what numbers do they give you? Is the IP that ShieldsUP shows for you different from what you have set in your router? If it is, and the router IP is within one of these ranges:
10.0.0.0 - 10.255.255.255
172.16.0.0 - 172.31.255.255
192.168.0.0 - 192.168.255.255
then you are behind a NAT box. That means that the ShieldsUP information is not for your machine but for one of your ISPs boxes.

[ardvark71]

Re: Strange firewall/internet connection issue...

Hi Ole...

I connect directly to the modem issued to me by Qwest since it comes with wireless capabilities.

I'm looking at the direct web page to my modem (a series of numbers in the address bar of my browser,) and it does have a series of firewall settings as well as a NAT table but I really have no idea of what I'm looking at. I'm pretty good with hardware but networking is an area that I really don't understand too well.

Regards...

[Ole Juul]

Re: Strange firewall/internet connection issue...

You should see a page with something like this:

IP Address: xxx.xxx.xxx.xxx
Subnet Mask: xxx.xxx.xxx.xxx
Default Gateway: xxx.xxx.xxx.xxx
DNS 1: xxx.xxx.xxx.xxx

That is the IP that the ISP gives you (usually using DHCP) and if that is different from what ShieldsUp is showing for you, then I am guessing that ShieldsUp is not seeing your computer. But I've been wrong before.

I'm better with hardware too, but this networking stuff has got me interested so I keep looking at it. It is fun to play with at home and gives an excuse to run old and obsolete hardware for servers or terminals or whatever.

[ardvark71]

Re: Strange firewall/internet connection issue...

Thanks Ole, I will have a look and get back with you...

Regards...

[ardvark71]

Re: Strange firewall/internet connection issue...

Hi Ole...

I went ahead and modified the modem's firewall setting from "off" to "medium." Now all the ports shown in ShieldsUP! come up as stealthed (green) and only one port, 23 Telnet, is closed or blue. I still don't understand why both iptables and Windows firewall gave the same report even though the modem firewall was turned off. Before I changed that setting, I noticed that the "Modem IP address" and the address listed on ShieldsUP! were the same.

Is there a way of checking my computer's IP address to see if it is different? I tried "ipconfig" in windows but the cmd window only stayed up for a split second.

Regards...

[Ole Juul]

Re: Strange firewall/internet connection issue...

The "Modem IP address" and the address listed on ShieldsUP! are the same. How do I check my computer's IP address in case it is different?

What ShieldsUP reports would be the same as everyone else sees. That is, your outward facing IP. If you want to double check, just websearch "what's my ip" and you'll get plenty of offers.

Hmm, that puts a big question mark about your open port. So, as I understand it, if that is the same number as your "modem ip address" then that is your computer, and what the outside world is looking at. Actually I guess it is your router, which is a computer to which your other computer is connected. I wonder what it is. Could it be the firmware in your router? Maybe it's time to netsearch your router model.

[ardvark71]

Re: Strange firewall/internet connection issue...

Hi Ole...

Thank you!

I edited the above post, I will have a look at "what's my IP?"

EDIT: whatismyipaddress.com gives me the exact same number. Interesting.

Regards...

[Ole Juul]

Re: Strange firewall/internet connection issue...

I've tried "ipconfig" on a Winbox and it worked. Presumably behind your router, your computer will have a private address, such as 192.168.1.1 or something in that range. To my amateurish understanding it is time to look at your modem/firewall since that is what is facing the world and what ShieldsUp is looking at.

[ardvark71]

Re: Strange firewall/internet connection issue...

To my amateurish understanding it is time to look at your modem/firewall since that is what is facing the world and what ShieldsUp is looking at.

Hi Ole...

I agree and I have changed the modem's firewall setting from "off" to "medium." What ShieldsUP! now reports is very different from before, for the good. I appreciate all your help. I consider this matter solved.

Regards...

[kubicle]

Re: Strange firewall/internet connection issue...

I've tried "ipconfig" on a Winbox and it worked.

In linux, you can use "ifconfig" command to get information on the network interfaces of your computer (including IP address of connected interfaces), which, as you mentioned, is different from the router's outward facing IP address, if the computer is behind a router (or a modem with routing capabilities).

[kubicle]

Re: Strange firewall/internet connection issue...

doublepost

[Ole Juul]

Re: Strange firewall/internet connection issue...

I consider this matter solved.

Excellent!