John Zornig wrote: > echo "1" > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal > > seems to work for my systems. No more INVALID packets. > > Some of the netfilter firewall how-to guides I've found say that > ip_conntrack_tcp_be_liberal should never be set on a firewall. So I'm > still left wondering if I'm working around a bug and my firewall is > not as strict as it should be, or are these how-to's all wrong. This is just a workaround for a bug. Are you using a recent kernel? It would be good to work with Jozsef to get this fixed if you are able to help debug it. Also report it on the netfilter-devel list. To debug, I think the first steps are to enable logging with: modprobe ipt_LOG echo 255 >/proc/sys/net/netfilter/nf_conntrack_log_invalid and check your syslog for errors. Also get a tcpdump of the ssh traffic with something like: tcpdump -i eth0 -s 0 -w dump.pcap tcp port 22 - To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
