This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

FTP not working well with SYN Rate Limiter ON

After installing our new ASL 5.200 firewall, customers are complaing about not being able to upload ZIP files to our FTP site.

I have confirmed this is true; small files (Code:

  2005:04:20-10:33:56 (none) kernel: DROP: IN=eth1 OUT=eth0 SRC=xxx.xxx.48.21 DST=199.107.154.233 LEN=40 TOS=0x00 PREC=0x00 TTL=127 ID=10567 DF PROTO=TCP SPT=2703 DPT=32790 WINDOW=8280 RES=0x00 ACK FIN URGP=0
2005:04:20-10:33:56 (none) kernel: DROP: IN=eth0 OUT=eth1 SRC=199.107.154.233 DST=xxx.xxx.48.21 LEN=1420 TOS=0x00 PREC=0x00 TTL=51 ID=2041 DF PROTO=TCP SPT=32790 DPT=2703 WINDOW=5840 RES=0x00 ACK URGP=0
2005:04:20-10:34:22 (none) kernel: DROP: IN=eth1 OUT=eth0 SRC=xxx.xxx.48.21 DST=199.107.154.233 LEN=40 TOS=0x00 PREC=0x00 TTL=127 ID=57430 DF PROTO=TCP SPT=2703 DPT=32790 WINDOW=8280 RES=0x00 ACK FIN URGP=0
2005:04:20-10:34:31 (none) kernel: DROP: IN=eth0 OUT=eth1 SRC=199.107.154.233 DST=xxx.xxx.48.21 LEN=1420 TOS=0x00 PREC=0x00 TTL=51 ID=2043 DF PROTO=TCP SPT=32790 DPT=2703 WINDOW=5840 RES=0x00 ACK URGP=0
2005:04:20-10:35:14 (none) kernel: DROP: IN=eth1 OUT=eth0 SRC=xxx.xxx.48.21 DST=199.107.154.233 LEN=40 TOS=0x00 PREC=0x00 TTL=127 ID=31354 DF PROTO=TCP SPT=2703 DPT=32790 WINDOW=8280 RES=0x00 ACK FIN URGP=0

Where 199... is the client and xxx... is our server behind ASL.

I have the FTP connection helper enabled.

AFAICS, turning off the SYN Rate Limiter fixes the problem.
This doesn't make sense to me.

Also, I don't think my ASL 5.2 box at home has this problem with FTP transfers, but I can't try it right now.

Thanks,
Barry

This thread was automatically locked due to age.

Parents

0 BarryG over 20 years ago

FWIW, this was using Passive FTP.

I'll try active later, but that's probably not going to be an option for our clients.

Thanks,
Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 20 years ago in reply to BarryG

Customer is still reporting problems with SYN limiter off... anyone have any ideas?

Thanks,
Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 bbb_01 over 20 years ago in reply to BarryG

Seems that astaro working on a fix for that, my collegue opened a case for this.

Astaro Support said that its a known Problem that the middleware deletes entries of the connection tracking table, it will be fixed soon etc...

B
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 20 years ago in reply to bbb_01

ACK!
Is there any workaround?

Thanks,
Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 ezekiel over 20 years ago in reply to BarryG

I sure Astaro finds a fix for this. I always thought the FTP problems I had were the users fault

Dan
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 ezekiel over 20 years ago in reply to BarryG

I sure Astaro finds a fix for this. I always thought the FTP problems I had were the users fault

Dan
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data