From mboxrd@z Thu Jan 1 00:00:00 1970 From: Pedro Abreu Subject: iptables/nat and out of window packets Date: Fri, 16 Feb 2007 17:00:16 +0000 Message-ID: <1171645216.5317.49.camel@localhost.localdomain> Reply-To: pedro.abreu@anubisnetworks.com Mime-Version: 1.0 Content-Type: multipart/signed; micalg=sha1; protocol="application/x-pkcs7-signature"; boundary="=-HCYJ49rzGsBBLHb2fOqJ" Return-path: List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org To: netfilter@lists.netfilter.org --=-HCYJ49rzGsBBLHb2fOqJ Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Hi, a few days ago I had to deal with the following situation: Mail RELAY: kernel 2.6.14.4-vs2.1.0 (vs for vserver patch) iptables v1.2.11 5mbit dedicated link under my control Mail STORE: openbsd firewall (unknown version) freebsd mail store (unknown version) 3mbit dedicated link out of my control RELAY forwards mail to STORE, which is on a totally different network. All traffic was flowing fine, except for large emails (>100kb was enough) which would timeout many times while sending the message body, specially when delivering more than one large mail at a time. After some investigation, I found that lots of invalid out of window packets were received by the RELAY when the timeouts occurred, using "echo 255 > ip_conntrack_log_invalid" for troubleshooting. Apparently, the solution was to "echo 1 > ip_conntrack_tcp_be_liberal" so that only RST packets would be considered invalid. I tried that, and it worked. My question is this: where exactly is the problem? - A know netfilter problem, for that kernel version? - A problem with the bsd stack/ipfilter? - Something else? Even after all the googling, I'm confused about this. Thanks for any help. Pedro Abreu --=-HCYJ49rzGsBBLHb2fOqJ Content-Type: application/x-pkcs7-signature; name=smime.p7s Content-Disposition: attachment; filename=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIJNzCCAvYw ggJfoAMCAQICEDeznNX5WhrhbL3Bm2Y111cwDQYJKoZIhvcNAQEEBQAwYjELMAkGA1UEBhMCWkEx JTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQ ZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4XDTA2MDcwNTE2MTI0MVoXDTA3MDcwNTE2MTI0 MVowUDEfMB0GA1UEAxMWVGhhd3RlIEZyZWVtYWlsIE1lbWJlcjEtMCsGCSqGSIb3DQEJARYecGVk cm8uYWJyZXVAYW51YmlzbmV0d29ya3MuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC AQEAvEe5/KzzO6Hmvh3hqBdPaUmb6qn6M6VMCXGw6MG6VORuBNHjfVJ3Pf8uPy/BeWLYFN3kpdbO LRi875pS7hmDr6a3xvx/bWW305k23GX7dm4HGlnRpdrhHDijac5RUQCt8tlgNLmyrZ2e4YquLpns 2YsHv4akqh39D3iocicpUbmx78whFz6YiQXvkih9dKxIlekP4sL+yrnYs/vP27XLLvCHPgCOziJQ g9qtvQZjA6e51USxjOwa7ri+Ifhw3ctOL/lg4uCkwOpv6Vf+V4795W+H4eh4x0Y96RDvrtUzzv7v 0IDfeUkxbULgA1+xhZcPl2o8dgwX74+5e2dl973MZQIDAQABozswOTApBgNVHREEIjAggR5wZWRy by5hYnJldUBhbnViaXNuZXR3b3Jrcy5jb20wDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQQFAAOB gQCKClESJCG5i3ltBSQcsXa+HIEzRLZvXAJlWpuh3/dRLjnPvlo3019oeQsC4dkXEWbFbYzeL/i7 oCxeaI2HkYCFL19aXp050qYi2FciOK0QPEbVtLJ8xT18CafG6rbQDkRx1W+h2dm+r2UoXJVqiX7L Z5uHDqzIex1rHg8IkMo2FzCCAvYwggJfoAMCAQICEDeznNX5WhrhbL3Bm2Y111cwDQYJKoZIhvcN AQEEBQAwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0 ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4XDTA2MDcw NTE2MTI0MVoXDTA3MDcwNTE2MTI0MVowUDEfMB0GA1UEAxMWVGhhd3RlIEZyZWVtYWlsIE1lbWJl cjEtMCsGCSqGSIb3DQEJARYecGVkcm8uYWJyZXVAYW51YmlzbmV0d29ya3MuY29tMIIBIjANBgkq hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvEe5/KzzO6Hmvh3hqBdPaUmb6qn6M6VMCXGw6MG6VORu BNHjfVJ3Pf8uPy/BeWLYFN3kpdbOLRi875pS7hmDr6a3xvx/bWW305k23GX7dm4HGlnRpdrhHDij ac5RUQCt8tlgNLmyrZ2e4YquLpns2YsHv4akqh39D3iocicpUbmx78whFz6YiQXvkih9dKxIlekP 4sL+yrnYs/vP27XLLvCHPgCOziJQg9qtvQZjA6e51USxjOwa7ri+Ifhw3ctOL/lg4uCkwOpv6Vf+ V4795W+H4eh4x0Y96RDvrtUzzv7v0IDfeUkxbULgA1+xhZcPl2o8dgwX74+5e2dl973MZQIDAQAB ozswOTApBgNVHREEIjAggR5wZWRyby5hYnJldUBhbnViaXNuZXR3b3Jrcy5jb20wDAYDVR0TAQH/ BAIwADANBgkqhkiG9w0BAQQFAAOBgQCKClESJCG5i3ltBSQcsXa+HIEzRLZvXAJlWpuh3/dRLjnP vlo3019oeQsC4dkXEWbFbYzeL/i7oCxeaI2HkYCFL19aXp050qYi2FciOK0QPEbVtLJ8xT18CafG 6rbQDkRx1W+h2dm+r2UoXJVqiX7LZ5uHDqzIex1rHg8IkMo2FzCCAz8wggKooAMCAQICAQ0wDQYJ KoZIhvcNAQEFBQAwgdExCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNV BAcTCUNhcGUgVG93bjEaMBgGA1UEChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsTH0NlcnRp ZmljYXRpb24gU2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJzb25hbCBGcmVl bWFpbCBDQTErMCkGCSqGSIb3DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhhd3RlLmNvbTAeFw0w MzA3MTcwMDAwMDBaFw0xMzA3MTYyMzU5NTlaMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3 dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1h aWwgSXNzdWluZyBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAxKY8VXNV+065yplaHmjA dQRwnd/p/6Me7L3N9VvyGna9fww6YfK/Uc4B1OVQCjDXAmNaLIkVcI7dyfArhVqqP3FWy688Cwfn 8R+RNiQqE88r1fOCdz0Dviv+uxg+B79AgAJk16emu59l0cUqVIUPSAR/p7bRPGEEQB5kGXJgt/sC AwEAAaOBlDCBkTASBgNVHRMBAf8ECDAGAQH/AgEAMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9j cmwudGhhd3RlLmNvbS9UaGF3dGVQZXJzb25hbEZyZWVtYWlsQ0EuY3JsMAsGA1UdDwQEAwIBBjAp BgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRUHJpdmF0ZUxhYmVsMi0xMzgwDQYJKoZIhvcNAQEFBQAD gYEASIzRUIPqCy7MDaNmrGcPf6+svsIXoUOWlJ1/TCG4+DYfqi2fNi/A9BxQIJNwPP2t4WFiw9k6 GX6EsZkbAMUaC4J0niVQlGLH2ydxVyWN3amcOY6MIE9lX5Xa9/eH1sYITq726jTlEBpbNU1341Yh eILcIRk13iSx0x1G/11fZU8xggMQMIIDDAIBATB2MGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxU aGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJl ZW1haWwgSXNzdWluZyBDQQIQN7Oc1flaGuFsvcGbZjXXVzAJBgUrDgMCGgUAoIIBbzAYBgkqhkiG 9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0wNzAyMTYxNzAwMTZaMCMGCSqGSIb3 DQEJBDEWBBSoT09HElHwSYmnWvuUoYrysLcmMjCBhQYJKwYBBAGCNxAEMXgwdjBiMQswCQYDVQQG EwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhh d3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0ECEDeznNX5WhrhbL3Bm2Y111cwgYcGCyqG SIb3DQEJEAILMXigdjBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcg KFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0EC EDeznNX5WhrhbL3Bm2Y111cwDQYJKoZIhvcNAQEBBQAEggEAn/JpDmscbTpmIz2Hzv5xS5PCJP6t /F2+5C89peLzeI7EY0HQuh2Qg9uJnO8zwGU8TVDRmKQ42U4EsoQbfUBaxpl6+MFO04U2NK2HnkrM cz81SBtbafQUOCrKgDQpO+oxqUbCYtEAMzIgOngtrtBcQZf5/GXPd6avsrgQ1GtYy34i84xArRDy PO9SCdzf80h0eaTk9KrzG0zlvs4o/rMYf4TmQrLJ0uBy0TQjK9hladbxg5rtkBIpjEYB9Wwmmc4r 0DHq57M3tbuApl7GyLH02YCsGv7hk85GlNa75GHEwJ9TlgICNjGKZUJyohHpTqhWqRKkLRxfU6yp 9CatFdH6JgAAAAAAAA== --=-HCYJ49rzGsBBLHb2fOqJ--