-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 03/08/2017 11:14 AM, Simon Matter wrote: >> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 >> >> On 03/07/2017 11:33 PM, Simon Matter wrote: >>> Hi Tom and all, >>> >>> Since upgrading from shorewall-5.1.1 to shorewall-5.1.2.1 I >>> have a new problem with longstanding TCP connections being >>> killed during "shorewall reload". >>> >>> This has never happened before so I guess it has something to >>> do with the new defaults. >>> >>> An interesting point is that it happens most of the time, but >>> not always. Seems it happens more if rules have been changed, >>> which probably means it happens more if the reload takes longer >>> to complete. >>> >>> The connection being killed is handled through this rule: DNAT >>> net dmz:bb.bb.bb.bb tcp 3217 - cc.cc.cc.cc >>> >>> Log shows: Mar 8 07:16:02 fw1 kernel: FORWARD REJECT IN=eth2 >>> OUT=eth2 SRC=aa.aa.aa.aa DST=bb.bb.bb.bb LEN=52 TOS=0x00 >>> PREC=0x00 TTL=55 ID=52512 DF PROTO=TCP SPT=40508 DPT=3217 >>> WINDOW=703 RES=0x00 ACK URGP=0 Mar 8 07:16:02 fw1 kernel: >>> FORWARD REJECT IN=eth2 OUT=eth2 SRC=aa.aa.aa.aa DST=bb.bb.bb.bb >>> LEN=40 TOS=0x00 PREC=0x00 TTL=55 ID=0 DF PROTO=TCP SPT=40508 >>> DPT=3217 WINDOW=0 RES=0x00 RST URGP=0 >>> >>> Do others see similar issues since upgrading to 5.1.2.1? >>> >> >> Hi Simon, > > Hi Tom, > >> You are the first to report this. Is this a Multi-ISP >> configuration? This looks like a routing problem; the packet is >> being routed back out of eth2 rather than to the DMZ interface. > > Thanks for taking a look at it! No, it's not a Multi-ISP > configuration. > > Most IP addresses on the internet side are proxyarped to the DMZ. > Maybe that explains why the packet is forwarded from eth2 to eth2, > while physically it then goes via eth1 to the host in DMZ? > > I tried to collect some more of the relevant information below: > > params: NET_IF="eth2" > NET_IFOPTIONS="dhcp,routefilter,logmartians,nosmurfs" > > interfaces: dmz eth1 net $NET_IF $NET_IFOPTIONS > > policy: fw net ACCEPT net all DROP info all > all REJECT info > > proxyarp: aa.aa.aa.aa eth1 eth2 bb.bb.bb.bb eth1 eth2 > > mangle: MARK(1) 0.0.0.0/0 0.0.0.0/0 tcp 3217 - - - > - Minimize-Delay MARK(1) 0.0.0.0/0 0.0.0.0/0 tcp - 3217 > - - - Minimize-Delay > > >> To rule out the new _DEFAULT settings, please switch back to >> using Reject and Drop and see of the problem persists. > > OK, I'll try this tomorrow early in the morning while nobody is > working already. > > I'm wondering if I should set the persistent flag for the entries > in proxyarp. But as I understand it should only matter for stop and > clear, not reload? >
Temporarily removing then re-adding Proxy ARP entries would not cause mis-routing. It would simply cause ARP "who-has" requests to time out. - -Tom - -- Tom Eastep \ Q: What do you get when you cross a mobster with Shoreline, \ an international standard? Washington, USA \ A: Someone who makes you an offer you can't http://shorewall.net \________________________________________________ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJYwIQjAAoJEJbms/JCOk0Q5/gP/2WoPv9lZC3IuJhTinRTS4di JYlOiEiJH64bHQXaDVbQrtglS7Cuj22owLPZNMH4l5zvv/PmuQjIZm8dCCetKyPI cIWBupAM0sutSsKF5h6mgW9AVVYB4EeXGTG8Ux1GVf509k7be4JGs8lmsG9A0CHr ATKY/BXr1Ou3k3yxpdkzhndimCrard6n1HU8WJf5bug/1kHS5KUkITcTH1qb4crc FcQqM0K6HoPb+04KXxkinXSYsA/dqm9Cshj1sqq5dexN4r9f96finjYiggTGQyug bSfJ7oUQTqgBnXO3wmRx+IyfLWzdteKpfDtHQ4a+CUKHfKQl/HodStsAlnAhhJHX 3BlpX/idQ2h9EHfH/xyDK8Fk0BCu1LY3RUGekfO4B/TdWlMXsayoBDwcqRgrnMGm 2JgUz0m0mA/Ez51SAInleLkPi8/ak+/269a2/Wx8jUO6voSjQuzYhdn9veVwFmgM SS53sB3DDzqXWB7xaqgJubP8PsXerpEefGBju9zhlBK0mFe1ufpSFkkRlHqg6iK8 IILYTcb4p+WTAMM1Es3X+w8qPGaGMFhFJh9u1vDlBZ9yffA5cpel1GH0sBQeLv5H FIKfZbLLRk4rt8nALGZ8eEFzc+DvmZL9VMsn/P29g4PRpBzgFTAwiF0KezMoKnbc O9QWeCjOX1Dga3tp8k6R =3cl3 -----END PGP SIGNATURE----- ------------------------------------------------------------------------------ Announcing the Oxford Dictionaries API! The API offers world-renowned dictionary content that is easy and intuitive to access. Sign up for an account today to start using our lexical data to power your apps and projects. Get started today and enter our developer competition. http://sdm.link/oxford _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
