Hi! To enhance the problem: The ICMP redirects are also blocked as invalid: kernel: RULE -1 -- DENY IN= OUT=eth2 SRC=194.95.188.7 DST=194.95.188.37 LEN=76 TOS=0x00 PREC=0xC0 TTL=64 ID=18322 PROTO=ICMP TYPE=5 CODE=1 GATEWAY=194.95.188.25 [SRC=194.95.188.37 DST=194.95.188.245 LEN=48 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=80 DPT=1246 WINDOW=5840 RES=0x00 ACK SYN URGP=0 ] What is invalid with this? Here again the rules that match (first rules of firewall script): $IPTABLES -N drop_invalid $IPTABLES -A OUTPUT -m state --state INVALID -j drop_invalid $IPTABLES -A INPUT -m state --state INVALID -j drop_invalid $IPTABLES -A FORWARD -m state --state INVALID -j drop_invalid $IPTABLES -A drop_invalid -j LOG --log-level debug --log-prefix "RULE -1 -- DENY " $IPTABLES -A drop_invalid -j DROP I think it could have something to do with the ACK and SYN flags. It seems to me the kernel doesn't recognise this packet as part of an established connection. Anyone with an explaination here or someone that shows me my nescience? Thanks Lars
