From: Pascal Hambourg <pascal.mail@plouf.fr.eu.org>
To: netfilter@vger.kernel.org
Subject: Re: Problem with getting reply packets
Date: Sat, 31 Jan 2009 11:32:29 +0100 [thread overview]
Message-ID: <498428BD.2000609@plouf.fr.eu.org> (raw)
In-Reply-To: <4983937B.4060200@bartk.us>
Hello,
Bart Kus a écrit :
>
> Setup: Inet -> Netgear -> WifiRouter -> CoreRouter
>
> Connection comes from inet to Netgear's public IP. DMZ on Netgear takes
> it to WifRouter's IP within the internal net of Netgear. DMZ on
> WifiRouter takes it to CoreRouter's IP. CoreRouter is running sshd and
> replies to WifiRouter. WifiRouter does NOT forward the packet to
> Netgear. A state is established in ip_conntrack but never matures
> beyond SYN_RECV status. Here's the iptables of WifiRouter:
[...]
> And here's the relevant ip_conntrack entry of WifiRouter after a SYN has
> been sent, and CoreRouter has properly transmitted a SYN+ACK back @
> WifiRouter:
>
> tcp 6 59 SYN_RECV src=98.233.248.36 dst=192.168.1.200 sport=50587
> dport=22 src=192.168.44.17 dst=98.233.248.36 sport=22 dport=50587 use=1
[...]
> Why is the reply (SYN+ACK) not being associated with this SYN_RECV state
> entry
It is. The SYN_RECV states indicates that the SYN+ACK was successfully
associated to the connection. Otherwise the conntrack entry would show
SYN_SENT and [UNREPLIED] instead.
> and being propagated back out to the internet?
No clue, sorry. Did you try to trace it through the iptables chains ?
next prev parent reply other threads:[~2009-01-31 10:32 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-01-30 23:55 Problem with getting reply packets Bart Kus
2009-01-31 10:32 ` Pascal Hambourg [this message]
2009-02-03 1:00 ` Bart Kus
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=498428BD.2000609@plouf.fr.eu.org \
--to=pascal.mail@plouf.fr.eu.org \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.