Netfilter cluster / Invalid state problem

Pablo Neira pablo at
Fri Aug 12 03:43:49 CEST 2005

Pierre Westeel wrote:
> I have a Linux netfilter cluster with keepalived to perform high avalaibility.
> The master runs a 2.6.12 kernel and the Backup runs a 2.4.26 kernel. (
> both from without patch )
> When I swap all the connections on the backup firewall with stopping
> keepalived daemon on master, the connections are correctly forwarded
> through the backup and I can see the new entry in
> /proc/net/ip_conntrack
> ( This is a VNC stream , the connexion is never Idle so the sequence
> number is increasing quickly )
> BUT when i restart the keepalived daemon to make connection go back
> through the master firewall 30 seconds after the first swap, i get the
> following logs :
> INVALID state -- DENY IN=eth0.730 OUT=eth0.732 SRC=
> DST= LEN=46 TOS=0x00 PREC=0x00 TTL=126 ID=46274 DF

Try this:

# echo 1 > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal

on the linux-2.6 box. See that later linux kernels 2.6 include TCP 
tracking active by default. Setting ip_conntrack_tcp_be_liberal to 1 
relaxes the in-window checkings. As you can figure out, if linux-2.6 
takes over, it won't know anything about the current active connections, 
so it will consider that they are invalid.


More information about the netfilter mailing list