Re: ssh connections stalling

[Mart Frauenlob <mart.frauenlob@chello.at>]

netfilter-owner@vger.kernel.org wrote:
> I'm having some troubles with what should be a very simple firewall to 
> simply protect a local machine.  When the firewall is enabled, ssh and 
> scp connections will sometimes hang indefinitely.  I've tried 
> configuring the firewall (which blocks all incoming requests to ports 
> 0:1023 except ssh and icmp) with several different tools: firehol, ufw 
> and lutelwall.  If the firewall is turned off, the problem 
> disappears.  With lutelwall there is an option to create a 
> non-stateful firewall - if that is done, the problem also disappears.
>
> My syslog does show dropped packets that appear to be the cause of the 
> problem.  From tcpdumps at both ends of the connection it looks like 
> the problem happens if large packets are sent out from behind the 
> firewall and then arrive in pieces at the other end with a piece 
> missing.  ack packets coming back in are dropped, and the connection 
> never recovers.
>
> Any help in diagnosing this would be much appreciated.
>
> Carl

Hello,

The rules you showed us, would all allow a local ssh server, so the 
ruleset is not the problem.
What confuses me, you talk about packets from behind the firewall, but 
your rulesets don't show any FORWARD rules that would even allow ssh.
If you would have, I'd say the problem may be fixable using the TCPMSS 
target:

TCPMSS
       [...]
       This target is used to overcome criminally braindead ISPs or 
servers which block "ICMP Fragmentation Needed" or "ICMPv6  Packet  Too  
Big"  packets.   The
       symptoms of this problem are that everything works fine from your 
Linux firewall/router, but machines behind it can never exchange large 
packets:
        1) Web browsers connect, then hang with no data received.
        2) Small mail works fine, but large emails hang.
        3) ssh works fine, but scp hangs after initial handshaking.
       [...]

If you need rules for a non routing (forwarding) machine, why do you 
talk about 'behind the firewall'?
Otherwise it's something else, than the ruleset.
Log outputs? tcpdumps? Distro? Kernel? iptables version?

Regards

Mart