I have a server that streams video to YouTube/Twitch. I see [UFW BLOCK] entries in logs. One IP is 184.108.40.206, the other is 220.127.116.11. Is it a common thing that a server is connecting to my server, like network analysis, or index building, something like this? What can be the reasons for unknown IP addresses in logs?
Yes it's extremely common to get seemingly random connections on any public IP and from random public IP.
Automated bots and hackers are constantly scanning the entire internet looking for new open/misconfigured/vulnerable hosts to break into.
It turns out you can do that as well with a utility called NMAP. But that would take days/weeks/years. Instead you could use ZMAP https://zmap.io/
If you get frequent scans there are a lot of things you can do to protect yourself. As others have mentioned add a firewall to block everything your not using (close all unused ports).
- os fingerprint protection
- turn off banners (avoid banner grabbing)
- implement a tar pit https://labrea.sourceforge.io/
- don't use out of the boxed default configurations
- change all default passwords
- patch OS vulns often
- disable all unused accounts
- turn off password authentication (SSH) - use certificates instead.
Yes. There are robots and port scanners. Your IP is reachable worldwide and all of you ports are potentially reachable. Therefore you should only let open the ports you really need.
Otherwise there are broadcast transmissions. Your node receive it without requested it.
Broadcasts are also used by service discovery protocols like DHCP. see also : https://en.wikipedia.org/wiki/Service_discovery
- Servers on the Internet with "open ports" are generally probed and attacked - so yes, it's very common to see strange addresses in the logs for unsecured services.
- You need to make sure that all ports are closed where not explicitly required.
- Also make sure that you only permit connections that you require - by source IP, subnet, ...
- (At least) all protocols that need to be open to the wide Internet need to be secured/hardened. You can only run server software that is "Internet grade".
#1 and #2 should be controlled by a decent firewall and configuration. If #3 isn't possible (because of dynamic/roaming users), consider setting up a VPN. #4 is the hardest part - if the vendor doesn't vouch for the server software you should consider an application-level firewall (which can be hell to set up).
If you leave any gaps in your security you will be hacked - tomorrow, next week, or maybe only next month.
The IP addresses you list are from China and Russia - addresses like these show up very early in the logs of any open service. Possibly they're the actual attackers, but more likely they are ignorant users that have lost control of their systems (and might not even know that yet).
When your server is reaching from " ANY " as source and destination as public server destination nat public ip allowing required ports in this case .your server is accessible from Any user or any network across the global towards your server considering inbound traffic . In this case you can see traffic logs in firewalls from unknow IPs because any one can reach your server as per your firewall policy configured
Source : ANY
Destination : server destination public ip
Ports : specific ports
To avoid not to access server from unknown IPs frame policy with souce as specific ip which your server want to access from..