On Wed, 2004-02-11 at 14:35, mgeschermann@xxxxxxxx wrote: > Hi all, > > I spend a lot of time on building my own firewall-script. Mostly everything is working fine (some things aren't tested yet), but I've got a tricky problem and hope you can help me. > > If I want to open the ebay-site from either the firewall or an client my browser tells me after a some seconds "This site could not be displayed." > > I've done some logging and noticed, that after the reply I get a packet with status "NEW" from ebay. (within a few seconds after the the first reply) > > > I'm running Suse 9.0 on my router/firewall with iptables 1.2.8. I'm using ip_conntrack. > (The problem occurs even without conntrack.) > > > here my rules: > > iptables -t nat -A PREROUTING -i $IFACE_LAN -p tcp -s $LOCAL_LAN --dport $HTTP_PORT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT > > iptables -A FORWARD -i $IFACE_LAN -o $IFACE_EXT -p tcp -s $LOCAL_LAN --dport $HTTP_PORT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT > > iptables -A FORWARD -i $IFACE_EXT -o $IFACE_LAN -p tcp -d $LOCAL_LAN --sport $HTTP_PORT -m state --state RELATED,ESTABLISHED -j ACCEPT Do you use a proxy server on the internal LAN? Try doing a tcpdump showing all traffic from and to the workstation and ebay web site. There was a 'problem' with earlier versions of IE where the browser would send a NEW packet after the connection was closed, never did figure out why? Regards Ray > -- -- Raymond Leach <raymondl@xxxxxxxxxxxxxxxxxxxxxx> Network Support Specialist http://www.knowledgefactory.co.za "lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import" Key fingerprint = 7209 A695 9EE0 E971 A9AD 00EE 8757 EE47 F06F FB28 --
Attachment:
signature.asc
Description: This is a digitally signed message part
