From: Richard Horton <arimus.uk@googlemail.com>
To: Dion Kant <msn@concero.nl>
Cc: netfilter@vger.kernel.org
Subject: Re: Packets ending up in wrong chain after DNAT
Date: Tue, 2 Mar 2010 10:12:44 +0000 [thread overview]
Message-ID: <56378e321003020212t17cdec48m6e414d89da208af2@mail.gmail.com> (raw)
In-Reply-To: <4B8C69FF.7050400@concero.nl>
On 2 March 2010 01:29, Dion Kant <msn@concero.nl> wrote:
> Mar 2 02:03:55 erouter kernel: [527925.765439] LOG 25 Wrong IN=eth2
> OUT= MAC=00:16:3e:78:4a:72:00:1d:45:8a:1b:2e:08:00 SRC=1.1.1.1
> DST=2.2.2.2 LEN=40 TOS=0x00 PREC=0x00 TTL=49 ID=0 DF PROTO=TCP SPT=53803
> DPT=25 WINDOW=0 RES=0x00 RST URGP=0
As I understand what you are trying to do is allow access to port 25
on your internal network from an external machine right?
If so that log looks odd - the originator of the connection is sending
a RESET flag. The Reset flag is sent by the destination (atleast from
my knowledge they are).
In which case that line is going to be classed as invalid state and so
won't work with conntrack as Matt points out.
From RFC793 (TCP):-
If the connection does not exist (CLOSED) then a reset is sent in
response to any incoming segment except another reset. In particular,
SYNs addressed to a non-existent connection are rejected by this
means.
If the connection is in any non-synchronized state (LISTEN, SYN-SENT,
SYN-RECEIVED), and the incoming segment acknowledges something not yet
sent (the segment carries an unacceptable ACK), or if an incoming
segment has a security level or compartment which does not exactly
match the level and compartment requested for the connection, a reset
is sent.
If the connection is in a synchronized state (ESTABLISHED, FIN-WAIT-1,
FIN-WAIT-2, CLOSE-WAIT, CLOSING, LAST-ACK, TIME-WAIT), any
unacceptable segment (out of window sequence number or unacceptible
acknowledgment number) must elicit only an empty acknowledgment
segment containing the current send-sequence number and an
acknowledgment indicating the next sequence number expected to be
received, and the connection remains in the same state.
--
Richard Horton
Users are like a virus: Each causing a thousand tiny crises until the
host finally dies.
http://www.solstans.co.uk - Solstans Japanese Bobtails and Norwegian Forest Cats
http://www.pbase.com/arimus - My online photogallery
next prev parent reply other threads:[~2010-03-02 10:12 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-03-02 1:29 Packets ending up in wrong chain after DNAT Dion Kant
2010-03-02 8:43 ` Mart Frauenlob
2010-03-02 10:12 ` Richard Horton [this message]
2010-03-02 18:01 ` Dion Kant
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56378e321003020212t17cdec48m6e414d89da208af2@mail.gmail.com \
--to=arimus.uk@googlemail.com \
--cc=msn@concero.nl \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox