Hi all,
I am having problems with a firewall here. The basic configuration
works perfectly, but we have occasional problems with DNAT. Long
running sessions (we have found the problem on ftp, http, pop and smtp
sessions) occasionally stall, and transfer no more data. Looking at the
firewall logs, I see:
INVALID NAT: IN=eth3 OUT= MAC=00:02:55:d6:eb:ae:00:11:bc:25:96:80:08:00
SRC=196.x.x.x DST=10.50.18.22 LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=37995
PROTO=TCP SPT=57952 DPT=80 WINDOW=65535 RES=0x00 ACK URGP=0
(This is logged by a -m state --state INVALID rule in the mangle table.)
The packet is then not natted, but drops into the INPUT chain for the
firewall itself, where it is dropped.
This seems to be the problem, as there are always one or more of these
messages on a stalled connection.
Looking at /proc/net/ip_conntrack immediately after the above message is
logged, I see:
tcp 6 295 ESTABLISHED src=196.x.x.x dst=10.50.18.22 sport=57952
dport=80 packets=5 bytes=633 src=192.168.1.22 dst=196.x.x.x sport=80
dport=57952 packets=12 bytes=13793 [ASSURED] mark=0 use=1
So the connection seems to be valid.
Any idea why this packet may be dropped, or are there other possible
reasons why the connection may be stalling?
Googling reveals a significant number of people having problems with
random stalls within a connection, but so far I have not seen a single
answer to the problem.
Any help/advice will be greatly appreciated.
Thanks,
Justin
