Is the Cisco PIX blocking ICMP On 7/27/05, Andrew <andrewna@xxxxxxxxxx> wrote: > Hi, > > I'm running Fedora Core 4 (Linux 2.6.11) with netfilter 1.30. > I've setup apache 2.54 to run at port 80. > > Basically when downloading large files(or pages) from apache, the download > stalls after the first few kilobytes or so. > > The configuration for the firewall in /etc/sysconfig/iptables is: > *filter > :INPUT ACCEPT [0:0] > :FORWARD ACCEPT [0:0] > :OUTPUT ACCEPT [0:0] > :RH-Firewall-1-INPUT - [0:0] > -A INPUT -j RH-Firewall-1-INPUT > -A FORWARD -j RH-Firewall-1-INPUT > -A OUTPUT -j ACCEPT > -A RH-Firewall-1-INPUT -i lo -j ACCEPT > -A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT > -A RH-Firewall-1-INPUT -p 50 -j ACCEPT > -A RH-Firewall-1-INPUT -p 51 -j ACCEPT > -A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT > -A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT > -A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT > -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j > ACCEPT > -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j > ACCEPT > -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j > ACCEPT > -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-port-unreachable > COMMIT > > The solution is to add set port 80 to allow INVALID packets: > > -A RH-Firewall-1-INPUT -m state --state NEW,ESTABLISHED,RELATED,INVALID -m > tcp -p tcp --dport 80 -j ACCEPT > > But the question is, why are subsequent packets coming from the remote > machine being identified as INVALID? Will allowing INVALID packets cause > other problems? > > The Linux machine is actually behind another Cisco PIX firewall. Could the > hardware firewall be translating the packets wrongly? Any ideas? > > Regards, > > Andrew > > > > -- Mohamed Eldesoky www.eldesoky.net RHCE
