From: Chris Wilson <chris@netservers.co.uk>
To: Juergen Stohr <juergen.stohr@lpr.e-technik.tu-muenchen.de>
Cc: netfilter@lists.netfilter.org
Subject: Re: bug? blocked packets get shadowed to internal network
Date: Thu, 14 Aug 2003 12:47:50 +0100 (BST) [thread overview]
Message-ID: <Pine.LNX.4.44.0308141245120.31438-100000@localhost> (raw)
In-Reply-To: <20030814133901.B23470@rcs.ei.tum.de>
Hi Juergen,
> we are using a firewall with RedHat kernel 2.4.20-19.7. The firewall is
> configured to block every packet with DPT 199 into our network.
You haven't given us your ruleset. Are you using a REJECT rule, especially
with TCP reset?
> IN= OUT=eth0 SRC=xxx.xxx.151.184 DST=xxx.xxx.11.231 LEN=40 TOS=0x00 PREC=0x00 TT
> L=255 ID=0 DF PROTO=TCP SPT=199 DPT=34869 WINDOW=0 RES=0x00 ACK RST URGP=0
This looks like a completely standard TCP reset. I can't tell for sure
without seeing your ruleset, but I suspect that either you are blocking
the incoming packet with -j REJECT --reject-with tcp-reset, or else it's
not being blocked at all, and what you see is the kernel resetting the
connection in the normal way (since it's not listening on that port).
Cheers, Chris.
--
___ __ _
/ __// / ,__(_)_ | Chris Wilson -- UNIX Firewall Lead Developer |
/ (_ / ,\/ _/ /_ \ | NetServers.co.uk http://www.netservers.co.uk |
\ _//_/_/_//_/___/ | 21 Signet Court, Cambridge, UK. 01223 576516 |
next prev parent reply other threads:[~2003-08-14 11:47 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-08-14 11:39 bug? blocked packets get shadowed to internal network Juergen Stohr
2003-08-14 11:47 ` Chris Wilson [this message]
[not found] <Pine.LNX.4.44.0308141501421.31438-100000@localhost>
[not found] ` <Pine.LNX.4.44.0308141506450.31438-100000@localhost>
2003-08-14 15:07 ` Juergen Stohr
-- strict thread matches above, loose matches on Subject: below --
2003-08-14 13:50 Juergen Stohr
2003-08-14 11:11 Juergen Stohr
2003-08-14 9:34 Juergen Stohr
2003-08-19 15:30 ` Arnt Karlsen
2003-09-04 6:53 ` Dharmendra.T
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Pine.LNX.4.44.0308141245120.31438-100000@localhost \
--to=chris@netservers.co.uk \
--cc=juergen.stohr@lpr.e-technik.tu-muenchen.de \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox