All of lore.kernel.org
 help / color / mirror / Atom feed
* Conntrack rule timeout problem
@ 2007-05-21 16:34 Pat Riehecky
  2007-05-23 12:47 ` Gáspár Lajos
  0 siblings, 1 reply; 5+ messages in thread
From: Pat Riehecky @ 2007-05-21 16:34 UTC (permalink / raw)
  To: netfilter

I seem to be capturing way more packets than I intend (or even expect!).
I am running squid and have the firewall rules below running on it.  For
some reason I am capturing hundreds of packets that I don't think should
be caught.

I have increased the timeouts in /proc/ (via sysctl) to fix this, but no
dice.  Anyone have any idea why the sample packet below would be
captured?  It is getting picked up by either the 
-A INPUT -p tcp -m tcp ! --syn -m conntrack --ctstate INVALID -j DROP
but sometimes the
-A INPUT -p tcp -m tcp ! --syn -m state --state NEW -j DROP

The packet looks to have been requested by squid, it is coming on port
80...  I also seem to be having the same behavior on the squid side
where the FIN/ACK packets are being caught by the conntrack rule...

I know I have something wrong, just what exactly is eluding me...

Any help would be helpful!

--- sample capture A ---
IN=eth0 OUT= MAC=00:0a:e9:6b:9e:ba:00:10:80:ec:37:5f:08:00
SRC=199.239.137.245 DST=XXX.YYY.ZZZ.AAA LEN=64 TOS=0x00 PREC=0x00 TTL=56
ID=620 DF PROTO=TCP SPT=80 DPT=60338 WINDOW=37260 RES=0x00 ACK URGP=0

--sample capture B ---
IN=eth0 OUT= MAC=00:0a:a9:60:9e:ba:00:10:80:ec:37:5f:08:00
SRC=222.28.249.164 DST=XXX.YYY.ZZZ.AAA LEN=40 TOS=0x00 PREC=0x00 TTL=109
ID=34912 DF PROTO=TCP SPT=1802 DPT=3128 WINDOW=65535 RES=0x00 ACK FIN
URGP=0

--- sysctl.conf ---
net.ipv4.netfilter.ip_conntrack_tcp_be_liberal=0
net.ipv4.netfilter.ip_conntrack_udp_timeout = 20
net.ipv4.netfilter.ip_conntrack_udp_timeout_stream = 95
net.ipv4.netfilter.ip_conntrack_generic_timeout=650
net.ipv4.netfilter.ip_conntrack_tcp_timeout_close=20
net.ipv4.netfilter.ip_conntrack_tcp_timeout_close_wait=180

--- rules ---
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state
--state NEW -j DROP
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack
--ctstate INVALID -j DROP
-A INPUT -p tcp -m tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW
-j REJECT --reject-with tcp-reset
-A INPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 4/sec
--limit-burst 9 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 113 -j REJECT --reject-with tcp-reset
-A INPUT -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3128 -m state --state NEW -j ACCEPT
-A INPUT -j DROP
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -s 255.0.0.0/255.0.0.0 -j DROP
-A OUTPUT -s 0.0.0.0/255.0.0.0 -j DROP
-A OUTPUT -s 192.168.0.0/255.255.0.0 -j DROP
-A OUTPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 9/sec
--limit-burst 15 -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 8 -j DROP
-A OUTPUT -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp -m multiport --dports 80,443 -m state --state NEW -j
ACCEPT
-A OUTPUT -j DROP



^ permalink raw reply	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2007-05-24 14:16 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-05-21 16:34 Conntrack rule timeout problem Pat Riehecky
2007-05-23 12:47 ` Gáspár Lajos
2007-05-23 13:42   ` Pat Riehecky
2007-05-23 16:27     ` Gáspár Lajos
2007-05-24 14:16       ` Pat Riehecky

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.