Problem downloading large files from Apache from far

Andrew andrewna at mymcsb.com
Thu Jul 28 02:47:36 CEST 2005


Hi M.Eldesoky,

Not that I know of, the configuration in the firewall:

conduit permit icmp any any

Thanks,

Andrew

-----Original Message-----
From: Mohamed Eldesoky [mailto:eldesoky.lists at gmail.com]
Sent: Wednesday, July 27, 2005 7:04 PM
To: Andrew
Cc: netfilter at lists.netfilter.org
Subject: Re: Problem downloading large files from Apache from far


Is the Cisco PIX blocking ICMP

On 7/27/05, Andrew <andrewna at mymcsb.com> wrote:
> Hi,
>
> I'm running Fedora Core 4 (Linux 2.6.11) with netfilter 1.30.
> I've setup apache 2.54 to run at port 80.
>
> Basically when downloading large files(or pages) from apache, the download
> stalls after the first few kilobytes or so.
>
> The configuration for the firewall in /etc/sysconfig/iptables is:
> *filter
> :INPUT ACCEPT [0:0]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [0:0]
> :RH-Firewall-1-INPUT - [0:0]
> -A INPUT -j RH-Firewall-1-INPUT
> -A FORWARD -j RH-Firewall-1-INPUT
> -A OUTPUT -j ACCEPT
> -A RH-Firewall-1-INPUT -i lo -j ACCEPT
> -A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
> -A RH-Firewall-1-INPUT -p 50 -j ACCEPT
> -A RH-Firewall-1-INPUT -p 51 -j ACCEPT
> -A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
> -A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
> -A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j
> ACCEPT
> -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j
> ACCEPT
> -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j
> ACCEPT
> -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-port-unreachable
> COMMIT
>
> The solution is to add set port 80 to allow INVALID packets:
>
> -A RH-Firewall-1-INPUT -m state --state NEW,ESTABLISHED,RELATED,INVALID -m
> tcp -p tcp --dport 80 -j ACCEPT
>
> But the question is, why are subsequent packets coming from the remote
> machine being identified as INVALID? Will allowing INVALID packets cause
> other problems?
>
> The Linux machine is actually behind another Cisco PIX firewall. Could the
> hardware firewall be translating the packets wrongly? Any ideas?
>
> Regards,
>
> Andrew
>
>
>
>


--
Mohamed Eldesoky
www.eldesoky.net
RHCE





More information about the netfilter mailing list