Linux Netfilter discussions
 help / color / mirror / Atom feed
* ssh session are hanging when firewall is restarted
@ 2011-08-24 13:42 Adishesh M
  2011-08-25  5:41 ` Adishesh M
                   ` (2 more replies)
  0 siblings, 3 replies; 8+ messages in thread
From: Adishesh M @ 2011-08-24 13:42 UTC (permalink / raw)
  To: netfilter

Hi,
When we insert below rules into the ip tables, ssh sessions are
hanging ( infact all tcp connection are terminated).

“iptables -A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m
state --state NEW -j DROP”.

what is the problem with this above rule. we used this rule to drop
bad tcp packets. when firewall is restarted using "service iptables
restart", ssh sessions are hanging.


Rule used for testing.

ssh session hangs
<set 1>
--------------------------
iptables -A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m
state --state NEW -j DROP
iptables -A INPUT -d 10.255.13.157 -m state --state
RELATED,ESTABLISHED  -j ACCEPT
iptables -A INPUT -d 10.255.13.157 -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A  INPUT -d 10.255.13.157   -j DROP


ssh session hangs
<set 2>
----------------------------
iptables -N TEST_LAN_1
iptables -A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m
state --state NEW -j DROP
iptables -A INPUT -d 10.255.13.157 -j TEST_LAN_1
iptables -A TEST_LAN_1 -d 10.255.13.157 -m state --state
RELATED,ESTABLISHED  -j ACCEPT
iptables -A TEST_LAN_1 -d 10.255.13.157 -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A  TEST_LAN_1 -d 10.255.13.157   -j DROP



ssh session does not hang
<set 3>
---------------------------------------
iptables -N TEST_LAN_1
iptables -A INPUT -d 10.255.13.157 -j TEST_LAN_1
iptables -A TEST_LAN_1 -d 10.255.13.157 -m state --state
RELATED,ESTABLISHED  -j ACCEPT
iptables -A TEST_LAN_1 -d 10.255.13.157 -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A  TEST_LAN_1 -d 10.255.13.157   -j DROP


ssh session does not hang
<set 4>
---------------------------------------
iptables -A INPUT -d 10.255.13.157 -m state --state
RELATED,ESTABLISHED  -j ACCEPT
iptables -A INPUT -d 10.255.13.157 -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A  INPUT -d 10.255.13.157   -j DROP


steps to reproduce the this issue
-----------------------------------------------
    iptables -F
    iptables  -X
    <Insert any one set of rules from set 1 or set 2 >
    service ip6tables stop
    service iptables save
    iptables -L -n
    service iptables restart
    iptables -L -n

Thanks and regards,
Adishesh

^ permalink raw reply	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2011-08-25 10:51 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-08-24 13:42 ssh session are hanging when firewall is restarted Adishesh M
2011-08-25  5:41 ` Adishesh M
2011-08-25  6:04 ` Grant Taylor
2011-08-25  7:28   ` Tyler J. Wagner
2011-08-25  8:06   ` Jan Engelhardt
2011-08-25 10:15 ` Pandu Poluan
2011-08-25 10:34   ` Adishesh M
2011-08-25 10:51     ` Tyler J. Wagner

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox