This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Problem with packet filter

I've created some rules that allow me to access to certain services. When I try to access those services I see that they are being droped at my firewall.
I'm masq'ing my LAN, I've defined services as such:
Name - TCP - 1024:65535 (source port) - 15204 (Destination port)
I've set packet filter rules to allow from LAN to Any using named service.
So why is it getting dropped at the firewall???
Any ideas?
Running Astaro 4.0.

This thread was automatically locked due to age.

Parents

0 Marcel_01 over 22 years ago

can you please post some lines from the livelog window and tell us about the ip's we see (what is internal, where is request coming from, etc.)

/marcel
Cancel
Vote Up 0 Vote Down

Cancel
0 Sgt_B over 22 years ago in reply to Marcel_01

I'll put it up as soon as I get home tonight. Thanks for the reply
Cancel
Vote Up 0 Vote Down

Cancel
0 Sgt_B over 22 years ago in reply to Sgt_B

Here are two entries from the firewall:

Mar 17 21:04:50 (none) kernel: TCP Drop: IN=eth0 OUT=eth1 SRC=192.168.3.2 DST=198.74.32.32 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=19736 DF PROTO=TCP SPT=4505 DPT=15204 WINDOW=16384 RES=0x00 SYN URGP=0

Mar 17 21:05:01 (none) kernel: TCP Drop: IN=eth0 OUT=eth1 SRC=192.168.3.2 DST=198.74.32.32 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=19737 DF PROTO=TCP SPT=4506 DPT=15200 WINDOW=16384 RES=0x00 SYN URGP=0

As stated, rules are in place that allow packets to be route via those ports. If I create a rule that allows the LAN to access Any via Any service, everything works fine. That is not a viable solution though.
Any ideas? I'm new to Astaro so I may be missing something simple.
Thanks!
Cancel
Vote Up 0 Vote Down

Cancel
0 LoosInt over 22 years ago in reply to Sgt_B

Maybe you have to change the order of your rules ?

Thomas
Cancel
Vote Up 0 Vote Down

Cancel
0 Sgt_B over 22 years ago in reply to LoosInt

No, those rules are allowed before anything is set to drop in the rulebase.
[:S]
Cancel
Vote Up 0 Vote Down

Cancel
0 jokey over 22 years ago in reply to Sgt_B

But a packet runs through the complete list, so putting accept rules like these to bottom of your ruleset is much better...
Cancel
Vote Up 0 Vote Down

Cancel
0 Gert Hansen over 22 years ago in reply to jokey

Hi there,

which version of ASL are you using?

Can you post the USR_FORWARD Chain,
listed in Packet Filter > Filter LiveLog > Current Packet Filter Rules.

kind regards
Gert
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Gert Hansen over 22 years ago in reply to jokey

Hi there,

which version of ASL are you using?

Can you post the USR_FORWARD Chain,
listed in Packet Filter > Filter LiveLog > Current Packet Filter Rules.

kind regards
Gert
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data