taeuber at bbaw.de
Thu Apr 19 13:10:56 CEST 2007
Jorge was very right.
The routing tables where not ballanced.
The gateway has had a route to the 220.127.116.11/26 network and so the requests for a tcp connection into this network have never been seen by the firewall. That's why the answers are invalid.
Sorry for this disturbance. But sometimes it helps to simply talk about problems.
Am Thu, 19 Apr 2007 11:23:38 +0200 schrieb Lars Täuber <taeuber at bbaw.de>:
> To enhance the problem:
> The ICMP redirects are also blocked as invalid:
> kernel: RULE -1 -- DENY IN= OUT=eth2 SRC=18.104.22.168 DST=22.214.171.124 LEN=76 TOS=0x00 PREC=0xC0 TTL=64 ID=18322 PROTO=ICMP TYPE=5 CODE=1 GATEWAY=126.96.36.199 [SRC=188.8.131.52 DST=184.108.40.206 LEN=48 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=80 DPT=1246 WINDOW=5840 RES=0x00 ACK SYN URGP=0 ]
> What is invalid with this?
> Here again the rules that match (first rules of firewall script):
> $IPTABLES -N drop_invalid
> $IPTABLES -A OUTPUT -m state --state INVALID -j drop_invalid
> $IPTABLES -A INPUT -m state --state INVALID -j drop_invalid
> $IPTABLES -A FORWARD -m state --state INVALID -j drop_invalid
> $IPTABLES -A drop_invalid -j LOG --log-level debug --log-prefix "RULE -1 -- DENY "
> $IPTABLES -A drop_invalid -j DROP
> I think it could have something to do with the ACK and SYN flags. It seems to me the kernel doesn't recognise this packet as part of an established connection.
> Anyone with an explaination here or someone that shows me my nescience?
Berlin-Brandenburgische Akademie der Wissenschaften
Jägerstrasse 22-23 10117 Berlin
Tel.: +49 30 20370-352 http://www.bbaw.de
More information about the netfilter