http-rules and browsing ebay Problem

http-rules and browsing ebay Problem

[mgeschermann]

Hi all,

I spend a lot of time on building my own firewall-script. Mostly everything is working fine (some things aren't tested yet), but I've got a tricky problem and hope you can help me.

If I want to open the ebay-site from either the firewall or an client my browser tells me after a some seconds "This site could not be displayed."

I've done some logging and noticed, that after the reply I get a packet with status "NEW" from ebay. (within a few seconds after the the first reply)


I'm running Suse 9.0 on my router/firewall with iptables 1.2.8. I'm using ip_conntrack.
(The problem occurs even without conntrack.)


here my rules:

iptables -t nat -A PREROUTING -i $IFACE_LAN -p tcp -s $LOCAL_LAN --dport $HTTP_PORT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i $IFACE_LAN -o $IFACE_EXT -p tcp -s $LOCAL_LAN --dport $HTTP_PORT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i $IFACE_EXT -o $IFACE_LAN -p tcp -d $LOCAL_LAN --sport $HTTP_PORT -m state --state RELATED,ESTABLISHED -j ACCEPT



I allready spent a lot of time on searching the and the mail-archive from netfilter but couldn't find a solution.

So I hope there is anyone reading this mail who can help me.

Thanks

M. Geschermann

http-rules and browsing ebay Problem

[mgeschermann]

Hi all,

I spend a lot of time on building my own firewall-script. Mostly everything is working fine (some things aren't tested yet), but I've got a tricky problem and hope you can help me.

If I want to open the ebay-site from either the firewall or an client my browser tells me after a some seconds "This site could not be displayed."

I've done some logging and noticed, that after the reply I get a packet with status "NEW" from ebay. (within a few seconds after the the first reply)


I'm running Suse 9.0 on my router/firewall with iptables 1.2.8. I'm using ip_conntrack.
(The problem occurs even without conntrack.)


here my rules:

iptables -t nat -A PREROUTING -i $IFACE_LAN -p tcp -s $LOCAL_LAN --dport $HTTP_PORT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i $IFACE_LAN -o $IFACE_EXT -p tcp -s $LOCAL_LAN --dport $HTTP_PORT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i $IFACE_EXT -o $IFACE_LAN -p tcp -d $LOCAL_LAN --sport $HTTP_PORT -m state --state RELATED,ESTABLISHED -j ACCEPT



I allready spent a lot of time on searching the and the mail-archive from netfilter but couldn't find a solution.

So I hope there is anyone reading this mail who can help me.

Thanks

M. Geschermann

Re: http-rules and browsing ebay Problem

[Antony Stone]

On Wednesday 11 February 2004 12:35 pm, mgeschermann@arcor.de wrote:

> Hi all,
>
> I spend a lot of time on building my own firewall-script. Mostly everything
> is working fine (some things aren't tested yet), but I've got a tricky
> problem and hope you can help me.
>
> If I want to open the ebay-site from either the firewall or an client my
> browser tells me after a some seconds "This site could not be displayed."
>
> I've done some logging and noticed, that after the reply I get a packet
> with status "NEW" from ebay. (within a few seconds after the the first
> reply)

What sort of packet?   Show us the log (preferably with both the original 
connection, and the new packet, including the timings).

Regards,

Antony.

-- 
There's no such thing as bad weather - only the wrong clothes.

 - Billy Connolly

                                                     Please reply to the list;
                                                           please don't CC me.

Re: http-rules and browsing ebay Problem

[Ray Leach]

[-- Attachment #1: Type: text/plain, Size: 1752 bytes --]

On Wed, 2004-02-11 at 14:35, mgeschermann@arcor.de wrote:
> Hi all,
> 
> I spend a lot of time on building my own firewall-script. Mostly everything is working fine (some things aren't tested yet), but I've got a tricky problem and hope you can help me.
> 
> If I want to open the ebay-site from either the firewall or an client my browser tells me after a some seconds "This site could not be displayed."
> 
> I've done some logging and noticed, that after the reply I get a packet with status "NEW" from ebay. (within a few seconds after the the first reply)
> 
> 
> I'm running Suse 9.0 on my router/firewall with iptables 1.2.8. I'm using ip_conntrack.
> (The problem occurs even without conntrack.)
> 
> 
> here my rules:
> 
> iptables -t nat -A PREROUTING -i $IFACE_LAN -p tcp -s $LOCAL_LAN --dport $HTTP_PORT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
> 
> iptables -A FORWARD -i $IFACE_LAN -o $IFACE_EXT -p tcp -s $LOCAL_LAN --dport $HTTP_PORT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
> 
> iptables -A FORWARD -i $IFACE_EXT -o $IFACE_LAN -p tcp -d $LOCAL_LAN --sport $HTTP_PORT -m state --state RELATED,ESTABLISHED -j ACCEPT

Do you use a proxy server on the internal LAN?

Try doing a tcpdump showing all traffic from and to the workstation and
ebay web site.

There was a 'problem' with earlier versions of IE where the browser
would send a NEW packet after the connection was closed, never did
figure out why?

Regards

Ray
> 
-- 
--
Raymond Leach <raymondl@knowledgefactory.co.za>
Network Support Specialist
http://www.knowledgefactory.co.za
"lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import"
Key fingerprint = 7209 A695 9EE0 E971 A9AD  00EE 8757 EE47 F06F FB28
--

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]