External IPs in access.log (Squid)

[Shafiq]

Hi,
I am running Squid/2.4.STABLE6 under Redhat Linux 9. Couple of days before suddenly access.log started showing entries like below:

1176886755.670 17 122.124.64.157 TCP_DENIED/403 985 CONNECT 203.188.197.10:25 - NONE/- -
1176886756.000 21 220.137.115.196 TCP_DENIED/403 979 CONNECT 168.95.5.25:25 - NONE/- -
1176886756.737 14 122.124.64.157 TCP_DENIED/403 985 CONNECT 203.188.197.10:25 - NONE/- -
1176886759.133 26 122.124.64.157 TCP_DENIED/403 985 CONNECT 203.188.197.10:25 - NONE/- -
1176886759.824 17 220.137.115.196 TCP_DENIED/403 983 CONNECT 203.188.197.9:25 - NONE/- -

While all these IPs are external to our LAN. Our LAN IPs are 192.168.0.x

I shall be very thankful if anyone will be able to help me.

Thank you.

[jledhead]

is your squid excessible to the outside in any way, even on other ports.

a whois lookup didn't help very much with those IPs but it does look like they are trying to connect thru your squid to another machines port 25. I would double check first the outside access to the machine and close it off if its not needed.

[Shafiq]

is your squid excessible to the outside in any way, even on other ports.

a whois lookup didn't help very much with those IPs but it does look like they are trying to connect thru your squid to another machines port 25. I would double check first the outside access to the machine and close it off if its not needed.

Thank you very much for the reply. Actually I don't know much about Linux. We are using this machine as a proxy server only and we don't need to access it from outside world. Kindly guide me how I can check open ports and close these if any?

[Roxoff]

It may not be a linux issue that you have...

Closing off the ports is a firewall change, and if you're running this as part of a company setup, you've probably got a standalone firewall. You need to close off access to this machine on the firewall - the general principle is to close down all access to everything - i.e. deny everything to everyone, then open up stuff that you want to get through - like email service (forward port 25 to your mail server) or access to a web server (forward port 80 to your apache machine), etc.