Virtualmin server tries to connect to it's external ip address

Submitted by sebastianmorsony on Thu, 12/02/2010 - 12:42 Pro Licensee

Hi

My virtualmin server tries to connect to it's external ip address all the time. Our firewall thinks it's Lan Attack. How can i stop this?

We translate ips in our firewall, so I can't connect to the external ip.

The xxx are really my external ip address. I got a lot of these.

monitor.p 6732 0 30u IPv4 78086616 TCP 10.128.255.21:47502->xxx.xxx.xxx.xxx:80 (SYN_SENT)

Status: 
Active

Comments

Submitted by JamieCameron on Thu, 12/02/2010 - 12:47

You might try turning off status monitoring of your website in Virtualmin, which is the main feature that I can think of which would connect to the external IP. This can be done at Edit Virtual Server -> Enabled Features.

Submitted by sebastianmorsony on Thu, 12/02/2010 - 14:37 Pro Licensee

How do I do this for all virtual servers?

Submitted by sebastianmorsony on Thu, 12/02/2010 - 14:50 Pro Licensee

Figured out how to disable for all virtual servers.

virtualmin disable-feature --all-domains --status

Submitted by Locutus on Thu, 12/02/2010 - 14:58

Additional hint: If turning that feature off does not solve the problem, you might find out which process is doing the connection attempts by issuing this command:

netstat -tnepc

This will continuously display the active TCP connections, including name of the initiating process. As soon as a "SYN_SENT" one appears to your external IP, you know who's the culprit. :)