Hi Tom and all, Since upgrading from shorewall-5.1.1 to shorewall-5.1.2.1 I have a new problem with longstanding TCP connections being killed during "shorewall reload".
This has never happened before so I guess it has something to do with the new defaults. An interesting point is that it happens most of the time, but not always. Seems it happens more if rules have been changed, which probably means it happens more if the reload takes longer to complete. The connection being killed is handled through this rule: DNAT net dmz:bb.bb.bb.bb tcp 3217 - cc.cc.cc.cc Log shows: Mar 8 07:16:02 fw1 kernel: FORWARD REJECT IN=eth2 OUT=eth2 SRC=aa.aa.aa.aa DST=bb.bb.bb.bb LEN=52 TOS=0x00 PREC=0x00 TTL=55 ID=52512 DF PROTO=TCP SPT=40508 DPT=3217 WINDOW=703 RES=0x00 ACK URGP=0 Mar 8 07:16:02 fw1 kernel: FORWARD REJECT IN=eth2 OUT=eth2 SRC=aa.aa.aa.aa DST=bb.bb.bb.bb LEN=40 TOS=0x00 PREC=0x00 TTL=55 ID=0 DF PROTO=TCP SPT=40508 DPT=3217 WINDOW=0 RES=0x00 RST URGP=0 Do others see similar issues since upgrading to 5.1.2.1? Regards, Simon ------------------------------------------------------------------------------ Announcing the Oxford Dictionaries API! The API offers world-renowned dictionary content that is easy and intuitive to access. Sign up for an account today to start using our lexical data to power your apps and projects. Get started today and enter our developer competition. http://sdm.link/oxford _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
