Re: Netfilter cluster / Invalid state problem

[Pablo Neira <pablo@eurodev.net>]

Pierre Westeel wrote:
> I have a Linux netfilter cluster with keepalived to perform high avalaibility.
> The master runs a 2.6.12 kernel and the Backup runs a 2.4.26 kernel. (
> both from kernel.org without patch )
> 
> When I swap all the connections on the backup firewall with stopping
> keepalived daemon on master, the connections are correctly forwarded
> through the backup and I can see the new entry in
> /proc/net/ip_conntrack
> ( This is a VNC stream , the connexion is never Idle so the sequence
> number is increasing quickly )
> 
> BUT when i restart the keepalived daemon to make connection go back
> through the master firewall 30 seconds after the first swap, i get the
> following logs :
> 
> INVALID state -- DENY IN=eth0.730 OUT=eth0.732 SRC=172.18.130.194
> DST=10.24.247.253 LEN=46 TOS=0x00 PREC=0x00 TTL=126 ID=46274 DF
> PROTO=TCP SPT=1522 DPT=5901 WINDOW=17520 RES=0x00 ACK PSH URGP=

Try this:

# echo 1 > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal

on the linux-2.6 box. See that later linux kernels 2.6 include TCP 
tracking active by default. Setting ip_conntrack_tcp_be_liberal to 1 
relaxes the in-window checkings. As you can figure out, if linux-2.6 
takes over, it won't know anything about the current active connections, 
so it will consider that they are invalid.

--
Pablo