Re: Problem accessing https://my.procurve.com/profile/index.aspx (ACK is over the upper bound)

[Patrick McHardy <kaber@trash.net>]

Jozsef Kadlecsik wrote:
> On Mon, 2 Jul 2007, Patrick McHardy wrote:
> 
>> Krzysztof Oledzki wrote:
>>
>>>
>>> OK, this was easy. The RST was sent simply because the packed was not
>>> dropped but instead delivered to the local IP - there was no valid tuple
>>> to change (unnat) the packed destination. Setting:
>>>
>>> iptables -I PREROUTING -m conntrack --ctstate INVALID -j DROP
>>
>>
>> We should really document that with window tracking and NAT you
>> must drop INVALID packets to avoid them getting delivered locally
>> and causing a RST.
> 
> 
> Couldn't we do it in NAT itself? I.e drop the packet by NAT if
> ip_conntrack_tcp_be_liberal is unset and the packet is INVALID.


I'm a bit sceptical about NAT core caring about TCP conntrack
specific sysctls, I'd prefer an unconditional drop.

> It'd be backward-incompatible as it'd change the current behaviour but
> were more safer (saner) than the present approach.


Yes, for this case it definitely makes sense. I'm just wondering
whether we'll break anything. Tools like nmap come to mind ..