Firewall reports UID Tracking hit where the causing IP is the Cloudflare IP

postcd

Hi, on my webserver im getting an firewall alerts of tracking hit. Subject of the email:
lfd on myhostname: UID *** (myhostingaccount) Tracking Hit

And the connection IP is the CLoudflare one while im not aware having cloudflare used on my site.

Feb * : hostname kernel: [******.******] Firewall: TCP_OUT Blocked IN= OUT=venet0 SRC=MYSERVERIP DST=162.159.245.61 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=60766 DF PROTO=TCP SPT=58931 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 UID=555 GID=563

SPT (source port) is variable acros connections

Why is the cloudflare IP involved and why using various SPT?

Thx

zafouhar

@postcd said:
Hi, on my webserver im getting an firewall alerts of tracking hit. Subject of the email:
lfd on myhostname: UID *** (myhostingaccount) Tracking Hit

And the connection IP is the CLoudflare one while im not aware having cloudflare used on my site.

Thx

You may want to remove your IP from a public forum

Edit: actually I misread and confused. The IP you have is Cloudflare's IP. It would seem something is connection from your server to the Cloudflare IP

Rallias

Are you using CSF with a country-code filter?

postcd

@Rallias said:
Are you using CSF with a country-code filter?

I think my CSF is not blocking any country, or not sure what you mean by country filter