Anyway, I have just (unbanned you again) tweaked that firewall rule so you should not get blocked again... Obviously only real-time testing will prove this either way...port 137 is associated with NetBIOS Name Service, commonly used in Windows networks for name resolution (e.g., translating computer names to IP addresses)
Ubuntu servers don’t typically listen on port 137 unless you’ve installed and configured Samba (for Windows file/printer sharing). If port 137 is closed, incoming UDP packets to it trigger ICMP "Port Unreachable" responses, which your Snort rule (1:402:16) flagged and led to the IP being banned
I will try and keep an eye on it in the firewall log throughout today, assuming you are going to be logged onto the forum all day so I can monitor it...
I've also noticed several other IP address are also accessing the same port, so I don't know if this is also blocking legitimate users or not because nobody else has said anything :roll:
