-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 03/07/2017 11:33 PM, Simon Matter wrote: > Hi Tom and all, > > Since upgrading from shorewall-5.1.1 to shorewall-5.1.2.1 I have a > new problem with longstanding TCP connections being killed during > "shorewall reload". > > This has never happened before so I guess it has something to do > with the new defaults. > > An interesting point is that it happens most of the time, but not > always. Seems it happens more if rules have been changed, which > probably means it happens more if the reload takes longer to > complete. > > The connection being killed is handled through this rule: DNAT > net dmz:bb.bb.bb.bb tcp 3217 - cc.cc.cc.cc > > Log shows: Mar 8 07:16:02 fw1 kernel: FORWARD REJECT IN=eth2 > OUT=eth2 SRC=aa.aa.aa.aa DST=bb.bb.bb.bb LEN=52 TOS=0x00 PREC=0x00 > TTL=55 ID=52512 DF PROTO=TCP SPT=40508 DPT=3217 WINDOW=703 RES=0x00 > ACK URGP=0 Mar 8 07:16:02 fw1 kernel: FORWARD REJECT IN=eth2 > OUT=eth2 SRC=aa.aa.aa.aa DST=bb.bb.bb.bb LEN=40 TOS=0x00 PREC=0x00 > TTL=55 ID=0 DF PROTO=TCP SPT=40508 DPT=3217 WINDOW=0 RES=0x00 RST > URGP=0 > > Do others see similar issues since upgrading to 5.1.2.1? >
Hi Simon, You are the first to report this. Is this a Multi-ISP configuration? This looks like a routing problem; the packet is being routed back out of eth2 rather than to the DMZ interface. To rule out the new _DEFAULT settings, please switch back to using Reject and Drop and see of the problem persists. - -Tom - -- Tom Eastep \ Q: What do you get when you cross a mobster with Shoreline, \ an international standard? Washington, USA \ A: Someone who makes you an offer you can't http://shorewall.net \________________________________________________ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJYwEAoAAoJEJbms/JCOk0Qz70QAIjNRtIM4lWk4IS0WmvTPtZE +ce899G1LwXEot5HWvvynoOCr8mwClIK0dvdxLFEp3oNuEzczlTEM3ZHA9Y8BsPe TctVdfzXaRiU6m+oFhyIAjA7klTbldjAeaQ6jRFHEchzd9QdsnPoaoQgSx9eMB9y W/RsjMGWZhV4oqgqBlg9DQJfqtZv0z+8YeGeJkdrObYpcJRfRd/DxU+I7WTCwmvj yXugUOi9WOupC7UhnsCkGjMP8YS68P2DSc5WheJzKYqQla22qO9e1OzO3hGAmerr bZ+wD+PG+V5jtxS0y6F78gaYHdSupHEGvUJ/JjNTy/f3OEVEii0y0d+eOoQNZSgu XvnUMjPPZdxP6B5zQTlM1UmLvbSNQbrJ68RSCaDekMuEw0stkSYCpo7AmVhmca24 GCGd2T5EVZrLrrLA//a7TeDYew/3Axwe7lgKAZIfc/tZPy3eYh+Vp5IElwgcZSwm 1TEZlnImX88EC9cCiIBkbnuVeSDIZrLBw9VmlRJJGOT0SCaiHx5f6By5WyrFu8St x86OOl0OGH7WPJWnhbhrW1sv/vVjeED0/PjI0utytuhqznWgN1c33WKyJTM/33Fj RRReoUjdNJHcV+R/du0GDIVIFawLCz5op9YLuS/IIR8sX0TX4iXwcPmimLzg/wFU L0ayMI/xproIH70U7nD5 =2w9i -----END PGP SIGNATURE----- ------------------------------------------------------------------------------ Announcing the Oxford Dictionaries API! The API offers world-renowned dictionary content that is easy and intuitive to access. Sign up for an account today to start using our lexical data to power your apps and projects. Get started today and enter our developer competition. http://sdm.link/oxford _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
