Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #2913

Re: IPtables flagging packets invalid, no access

From Pascal Hambourg <boite-a-spam@plouf.fr.eu.org>
Newsgroups comp.os.linux.networking
Subject Re: IPtables flagging packets invalid, no access
Date 2014-04-20 20:24 +0200
Organization Plouf !
Message-ID <lj13c1$2uss$1@saria.nerim.net> (permalink)
References <97fe2901-7de0-46b6-9629-34824f83f714@googlegroups.com> <f4b44677-59b6-4e61-8de8-987594558ec4@googlegroups.com> <lj0u41$2t32$1@saria.nerim.net> <a9342d7f-62e6-4c70-9c9c-60007ef95974@googlegroups.com>

Show all headers | View raw

86brown a écrit :
> 
> I've compared the rules on a working server to non-working server, and
> even copied the configuration of csf to the non-working server and there
> are no changes.

You keep talking about invalid packets, but you wrote in your first post
that most firewall log messages were flagged "TCP_IN Blocked", not
"INVALID". So what's the bigger problem ?

Besides, we don't know what do these messages mean exactly. You need to
check which rules produce them.
Is it "INVALID" per the connection tracking ? AFAIK a TCP SYN packet
cannot have the INVALID conntrack state, unless a connection with the
same characteristics already exists (and the packet would be discarded
by the TCP layer anyway), or the conntrack table is full. If "INVALID"
meant "malformed" (e.g. bad checksum), then the packet would also be
discarded by the TCP/IP stack regardless of iptables.

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

IPtables flagging packets invalid, no access 86brown <86brown@gmail.com> - 2014-04-19 13:13 -0700
  Re: IPtables flagging packets invalid, no access Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-04-20 11:27 +0200
    Re: IPtables flagging packets invalid, no access 86brown <86brown@gmail.com> - 2014-04-22 20:10 -0700
      Re: IPtables flagging packets invalid, no access Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-04-24 00:30 +0200
  Re: IPtables flagging packets invalid, no access 86brown <86brown@gmail.com> - 2014-04-20 09:20 -0700
    Re: IPtables flagging packets invalid, no access Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-04-20 18:54 +0200
      Re: IPtables flagging packets invalid, no access 86brown <86brown@gmail.com> - 2014-04-20 10:23 -0700
        Re: IPtables flagging packets invalid, no access Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-04-20 20:24 +0200
          Re: IPtables flagging packets invalid, no access 86brown <86brown@gmail.com> - 2014-04-20 16:51 -0700
            Re: IPtables flagging packets invalid, no access 86brown <86brown@gmail.com> - 2014-04-21 12:26 -0700
              Re: IPtables flagging packets invalid, no access Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-04-22 01:34 +0200
                Re: IPtables flagging packets invalid, no access 86brown <86brown@gmail.com> - 2014-04-21 17:15 -0700

csiph-web