This Board And Sygate Pro

[nikita69]

I'm not sure if here is the best place to post this. I have NAV and sygate firewall pro 2.1. no problems, util 4 days ago, every now and then when i'm posting or previewing a post, i see sygate's icon turning into red. looking at the log, i see it blocked my dsl setup page 192.168.1.254. I believe this issue is just a matter of settings. I have cookies enabled for the board, along with the always accept warning i got orignially from sygate about 207.218.251.60. this is what sygate's log said. any suggestions?

Ethernet II (Packet Length: 60)
	Destination: 00-50-f2-c8-ee-76
	Source: 00-06-25-d8-ed-9f
Type: IP (0x0800)
Internet Protocol
	Version: 4
	Header Length: 20 bytes
	Flags:
 .1.. = Don't fragment: Set
 ..0. = More fragments: Not set
	Fragment offset:0
	Time to live: 49
	Protocol: 0x6 (TCP - Transmission Control Protocol)
	Header checksum: 0x1fbd (Correct)
	Source: 192.149.252.43
	Destination: 10.10.10.5
Transmission Control Protocol (TCP)
	Source port: 43
	Destination port: 3194
	Sequence number: 463763500
	Acknowledgment number: 52448139
	Header length: 20
	Flags: 
 0... .... = Congestion Window Reduce (CWR): Not set
 .0.. .... = ECN-Echo: Not set
 ..0. .... = Urgent: Not set
 ...1 .... = Acknowledgment: Set
 .... 0... = Push: Not set
 .... .0.. = Reset: Not set
 .... ..0. = Syn: Not set
 .... ...0 = Fin: Not set
	Checksum: 0x6f6d (Correct)
	Data (0 Bytes)

[TheMusicMan]

Thats the server IP for this board.

If you type http://207.218.251.60 to your browser you will end up here too so nothing to worry about

[nikita69]

I knew that, i was asking the block it self to my dsl. this happens only with this site/ip

[TheMusicMan]

I think thats some sort of warning cause your firewall did notice that the server ip changed from the old IP to this one.

Some spyware hijack's domain names and most firewalls notice that - in this case the IP did really change so maybe you have to change your settings somewhere to "tell" your firewall that it is the real ip

Sorry if i cant help more since i don't have that firewall - maybe another user knows how to make that settings

Good luck !

[nikita69]

thx. balamm the expert may assist me on this one.

another came thru but i bit different, just when i was posting. the only way for me to post was to "allow all", post, then change it back "normal"

Ethernet II (Packet Length: 70)
	Destination:  00-50-f2-c8-ee-76
	Source:  00-06-25-d8-ed-9f
Type: IP (0x0800)
Internet Protocol
	Version: 4
	Header Length: 20 bytes
	Flags:
  .0.. = Don't fragment: Not set
  ..0. = More fragments: Not set
	Fragment offset:0
	Time to live: 63
	Protocol: 0x1 (ICMP - Internet Control Message Protocol)
	Header checksum: 0x10a5 (Correct)
	Source: 192.168.1.254
	Destination: 10.10.10.5
Internet Control Message Protocol
	Type: 3 (Destination Unreachable)
	Code: 4 (Fragmentation Required, but the Do Not Fragment flag is set)
	Data (32 bytes)

[balamm]

Why are you using Sygate 2.1 ?

The latest is 5.1

The icon changes color normally, green or pale blue for normal, allowed communications, and red for blocked or checking. I never pay any attention to it.

You should get a pop up asking permit or block with the "always" option checkbox.

decide what you want based on the URL in the IE address bar, or the outbound or remote connection ID and protocol shown in the pop up.

If you aren't sure, do nothing. If your page won't open, close it and reopen it.

If you need an updated firewall, PM me.

[nikita69]

thx for the reply. yes it's 5.1 build 1615s, i don't know why i wrote 2.1. I got the pop up for the boards IP and selected YES-ALWAYS. the closing and opening of IE doesn't always work, either I have to wait couple of minutes or so (until such block times out) OR select ALLOW ALL OR simply EXIT and Open sygate.

09/07/2003 23:55:14 Blocked ICMP Incoming 10.10.10.5 4 192.168.1.254 3 25 09/07/2003 23:54:27 09/07/2003 23:55:13 Block_all (*rule name*)

[balamm]

Yeah, Sygate can be stubborn at times. Better that than missing things though. I wonder if it's the banners you're seeing?

Or.... you mentioned your setup page ????

Is it maybe DHCP refreshing your lease?

[nikita69]

I don't see the banners, probably blocked by sygate (don't have other program that would do so). the setup page for my dsl is 192.168.1.254, it's web based instead of software based like ewire or other mdms. The DHCP was a good tip, but that doesn't seem to be the issue. both my modem setup and linksys are setup for 1 day.

btw, i isolated the problem to sygate by connecting the cable directly to pc (w/o linksys) and rebooted w/o sygate. ip is not blocked and ur site is working fine (slow at times though).

what i still don't understand is why just http://www.klboard.ath.cx ??? all other sites, i mean all (other boards too) are working fine and fast.

[balamm]

There is something here I think. I have to restart or reinstall IE every once in a while as it seems to breakdown. Almost as if it's been stressed. It may be in the DynDNS connections or in hidden code- someone mentioned a "hide script". ??