Hello, Olaf Zaplinski a écrit : > > since Dec. 1st I see 60 rejected packets from well known and "good" > SMTP hosts: > > Dec 2 12:12:02 binky kernel: [873572.327219] iptables-INVALID IN=eth0 > OUT= MAC=00:f1:70:00:58:f0:fc:fb:fb:2d:55:48:08:00 SRC=213.165.67.104 > DST=109.75.188.214 LEN=40 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP > SPT=25 DPT=37022 SEQ=3171195917 ACK=0 WINDOW=0 RES=0x00 RST URGP=0 > > Why are these logged and rejected? Because your rules below say so. > The rules: > > $IPTABLES -A INPUT -m conntrack --ctstate INVALID -m limit \ > --limit 3/s -j LOG --log-prefix="iptables-INVALID " \ > --log-tcp-sequence --log-tcp-options > > $IPTABLES -A INPUT -m conntrack --ctstate INVALID -j DROP > > I think this packet was part of the TCP closing handshake, so it should > have been ESTABLISHED and not INVALID. Am I wrong? RST is not part of the normal TCP closing handshake (FIN+ACK, FIN+ACK, ACK). My guess is that this packet is related to an old connection which is considered already closed by conntrack. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
