Problem resolved!

Lars Täuber taeuber at
Thu Apr 19 13:10:56 CEST 2007

Jorge was very right.

The routing tables where not ballanced.
The gateway has had a route to the network and so the requests for a tcp connection into this network have never been seen by the firewall. That's why the answers are invalid.

Sorry for this disturbance. But sometimes it helps to simply talk about problems.


Am Thu, 19 Apr 2007 11:23:38 +0200 schrieb Lars Täuber <taeuber at>:

> Hi!
> To enhance the problem:
> The ICMP redirects are also blocked as invalid:
> kernel: RULE -1 -- DENY IN= OUT=eth2 SRC= DST= LEN=76 TOS=0x00 PREC=0xC0 TTL=64 ID=18322 PROTO=ICMP TYPE=5 CODE=1 GATEWAY= [SRC= DST= LEN=48 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=80 DPT=1246 WINDOW=5840 RES=0x00 ACK SYN URGP=0 ] 
> What is invalid with this?
> Here again the rules that match (first rules of firewall script):
>  $IPTABLES -N drop_invalid
>  $IPTABLES -A OUTPUT   -m state --state INVALID  -j drop_invalid
>  $IPTABLES -A INPUT    -m state --state INVALID  -j drop_invalid
>  $IPTABLES -A FORWARD  -m state --state INVALID  -j drop_invalid
>  $IPTABLES -A drop_invalid  -j LOG  --log-level debug --log-prefix "RULE -1 -- DENY "
>  $IPTABLES -A drop_invalid  -j DROP
> I think it could have something to do with the ACK and SYN flags. It seems to me the kernel doesn't recognise this packet as part of an established connection.
> Anyone with an explaination here or someone that shows me my nescience?
> Thanks
> Lars

Berlin-Brandenburgische Akademie der Wissenschaften
Jägerstrasse 22-23                     10117 Berlin
Tel.: +49 30 20370-352 

More information about the netfilter mailing list