On Fri, 23 Oct 2009, Carl Michal wrote: > so if I replace firehol's rules to allow INVALID packets like this: > > iptables -R in_world_ssh_s4 1 -p tcp --dport 22 -m state --state > NEW,INVALID,ESTABLISHED -j ACCEPT > iptables -R out_world_ssh_s4 1 -p tcp --sport 22 -m state --state > INVALID,ESTABLISHED -j ACCEPT > > Then my stalls go away. > > It needs both though. If just the input allows invalid, then the output > packets start being dropped. > > Is there some way to figure out why my packets are being marked invalid? Log the INVALID packets. Also, it'd be good if you could capture them by tcpdump (please use the -Sv options at least). Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlec@xxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : KFKI Research Institute for Particle and Nuclear Physics H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
