Jorge was very right.
The routing tables where not ballanced.
The gateway has had a route to the 194.95.188.0/26 network and so the requests for a tcp connection into this network have never been seen by the firewall. That's why the answers are invalid.
Sorry for this disturbance. But sometimes it helps to simply talk about problems.
Thanks.
Lars
Am Thu, 19 Apr 2007 11:23:38 +0200 schrieb Lars Täuber <taeuber@xxxxxxx>:
> Hi!
>
> To enhance the problem:
>
> The ICMP redirects are also blocked as invalid:
>
> kernel: RULE -1 -- DENY IN= OUT=eth2 SRC=194.95.188.7 DST=194.95.188.37 LEN=76 TOS=0x00 PREC=0xC0 TTL=64 ID=18322 PROTO=ICMP TYPE=5 CODE=1 GATEWAY=194.95.188.25 [SRC=194.95.188.37 DST=194.95.188.245 LEN=48 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=80 DPT=1246 WINDOW=5840 RES=0x00 ACK SYN URGP=0 ]
>
> What is invalid with this?
>
> Here again the rules that match (first rules of firewall script):
> $IPTABLES -N drop_invalid
> $IPTABLES -A OUTPUT -m state --state INVALID -j drop_invalid
> $IPTABLES -A INPUT -m state --state INVALID -j drop_invalid
> $IPTABLES -A FORWARD -m state --state INVALID -j drop_invalid
> $IPTABLES -A drop_invalid -j LOG --log-level debug --log-prefix "RULE -1 -- DENY "
> $IPTABLES -A drop_invalid -j DROP
>
> I think it could have something to do with the ACK and SYN flags. It seems to me the kernel doesn't recognise this packet as part of an established connection.
> Anyone with an explaination here or someone that shows me my nescience?
>
> Thanks
> Lars
>
--
Informationstechnologie
Berlin-Brandenburgische Akademie der Wissenschaften
Jägerstrasse 22-23 10117 Berlin
Tel.: +49 30 20370-352 http://www.bbaw.de
