Re: Valid packets blocked as invalid?

[Jorge Davila <davila@nicaraguaopensource.com>]

I'm guessing a routing problem here. If you see the log you can see that the 
packet marked as invalid have the same incoming/outgoing interface.

Your diagram, as you said is:

eth2
|
|
+--- gtw 194.95.188.25 --- LAN 194.95.188.192.
|
|
LAN 194.95.188.0/26

The gateway behind eth2 is in the same first network and you don't need a 
route in the box (the eth2 box) for the LAN behind the gateway because is 
managed for the gateway behind eth2.

This is the reason, the packet is not being routed properly.

Hope this help,

Jorge.

On Wed, 18 Apr 2007 15:19:41 +0200
  Lars Täuber <taeuber@bbaw.de> wrote:
> Hi everybody!
> 
> I just subscribed and haven't found any hints on the net.
> 
> We here have some packets dropped as invalid, but I don't understand why 
>they are invalid and which part of iptables/kernel marks it as invalid.
> So I ask for a hint where to look first or how to debug this. I'm a bit 
>familiar with ethereal/wireshark.
> 
> The situation:
> 
> - Linux hippo1 2.6.18.8-0.1-default #1 SMP Fri Mar 2 13:51:59 UTC 2007 
>i686 athlon i386 GNU/Linux
> - openSUSE 10.2 (i586)
> - iptables v1.3.6
> 
> eth0, eth1, lo and
> eth2 = 194.95.188.7 / 255.255.255.192 !!
> 
> 2 different networks are connected to eth2:
> 194.95.188.0   / 26 (directly) and
> 194.95.188.192 / 26 through gateway 194.95.188.25
> 
> routes:
> 
> Kernel IP routing table
> Destination     Gateway         Genmask         Flags Metric Ref    Use 
>Iface
> 194.95.188.192  194.95.188.25   255.255.255.192 UG    0      0        0 
>eth2
> 194.95.188.0    0.0.0.0         255.255.255.192 U     0      0        0 
>eth2
> 
> important iptables rules (in this order):
> 
> $IPTABLES -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
> $IPTABLES -A OUTPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT
> $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
> 
> # drop packets that do not match any valid state 
> #
> $IPTABLES -N drop_invalid
> $IPTABLES -A OUTPUT   -m state --state INVALID  -j drop_invalid
> $IPTABLES -A INPUT    -m state --state INVALID  -j drop_invalid
> $IPTABLES -A FORWARD  -m state --state INVALID  -j drop_invalid
> $IPTABLES -A drop_invalid  -j LOG  --log-level debug --log-prefix "RULE -1 
>-- DENY "
> $IPTABLES -A drop_invalid  -j DROP
> 
> 
> and now the bad log entry:
> 
> kernel: RULE -1 -- DENY IN=eth2 OUT=eth2 SRC=194.95.188.38 
>DST=194.95.188.233 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP 
>SPT=80 DPT=49272 WINDOW=5792 RES=0x00 ACK SYN URGP=0
> 
> This is answer of a packet that gets through the firewall because of this 
>rules:
> 
> $IPTABLES -A FORWARD -i eth2 -s 194.95.188.192/26 -m state --state NEW -j 
>ACCEPT 
> $IPTABLES -A FORWARD -p tcp -m tcp -m multiport -d 194.95.188.38 --dports 
>80,22,10080,10180 -m state --state NEW -j ACCEPT
> 
> 
> Could someone tell me what happens here?
> 
> Thank you and best regards.
> Lars
> 
> -- 
>                            Informationstechnologie
> Berlin-Brandenburgische Akademie der Wissenschaften
> Jägerstrasse 22-23                     10117 Berlin
> Tel.: +49 30 20370-352           http://www.bbaw.de
> 
> 

Jorge Isaac Davila Lopez
Nicaragua Open Source
davila@nicaraguaopensource.com