From: Pascal Hambourg <pascal.mail@plouf.fr.eu.org>
To: netfilter@vger.kernel.org
Subject: Re: Problem with getting reply packets
Date: Sat, 31 Jan 2009 11:32:29 +0100 [thread overview]
Message-ID: <498428BD.2000609@plouf.fr.eu.org> (raw)
In-Reply-To: <4983937B.4060200@bartk.us>
Hello,
Bart Kus a écrit :
>
> Setup: Inet -> Netgear -> WifiRouter -> CoreRouter
>
> Connection comes from inet to Netgear's public IP. DMZ on Netgear takes
> it to WifRouter's IP within the internal net of Netgear. DMZ on
> WifiRouter takes it to CoreRouter's IP. CoreRouter is running sshd and
> replies to WifiRouter. WifiRouter does NOT forward the packet to
> Netgear. A state is established in ip_conntrack but never matures
> beyond SYN_RECV status. Here's the iptables of WifiRouter:
[...]
> And here's the relevant ip_conntrack entry of WifiRouter after a SYN has
> been sent, and CoreRouter has properly transmitted a SYN+ACK back @
> WifiRouter:
>
> tcp 6 59 SYN_RECV src=98.233.248.36 dst=192.168.1.200 sport=50587
> dport=22 src=192.168.44.17 dst=98.233.248.36 sport=22 dport=50587 use=1
[...]
> Why is the reply (SYN+ACK) not being associated with this SYN_RECV state
> entry
It is. The SYN_RECV states indicates that the SYN+ACK was successfully
associated to the connection. Otherwise the conntrack entry would show
SYN_SENT and [UNREPLIED] instead.
> and being propagated back out to the internet?
No clue, sorry. Did you try to trace it through the iptables chains ?
next prev parent reply other threads:[~2009-01-31 10:32 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-01-30 23:55 Problem with getting reply packets Bart Kus
2009-01-31 10:32 ` Pascal Hambourg [this message]
2009-02-03 1:00 ` Bart Kus
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=498428BD.2000609@plouf.fr.eu.org \
--to=pascal.mail@plouf.fr.eu.org \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox