Re: Problem with conntrack idle connection timeout

[KOVACS Krisztian <hidden@balabit.hu>]

  Hi,

On Friday 04 November 2005 16.19, Manuel Marquez wrote:
> The problem is the use a JDBC connection pool and (I think) the linux
> firewall drops the pool connections after about 600 seconds of idle
> time. They can change the pool to make it reconnect whenever this
> happens, but they are planning to set up another interface (backend
> network) and move the oracle server there. If they did this, sqlplus
> and oracle forms would also get disconnected after this idle period
> (they have made tests with the same results on an oracle server
> connected to the DMZ). It also happens with SSH connections to the
> application (Tomcat 5) server.

  Then there must be some other problem which is not directly related to 
TCP timeout values in Netfilter. If connection tracking is working 
properly, established TCP connections will time out only after five 
days.

  A somewhat more detailed inspection of the firewall ruleset could help 
you identifying the portion of the ruleset where the packets get 
dropped. (A couple of well placed LOG rules can do a wonder.) BTW, you 
did not even mention what version of Linux is running on the firewall.

-- 
 Regards,
  Krisztian Kovacs