This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

packets dropped before packet filter !

hi, I'm using novell security manager (astaro) and it drops some packets. I have DMZ network and I do DNAT. But some packets are dropped before packet filter(their destination address is not DNAT translated). Sometimes it's FIN/ACK packets and sometimes just random.[:S]

should I post some logs or is it normal that it drops packets that are ...[8-)] 'Invalid' ?

This thread was automatically locked due to age.

Parents

0 Mike_H over 18 years ago

Please post some logs and what you are trying to do with the DNAT rule.
Is it working?
Packets will always get dropped by the default drop rule if you do not define a rule for them
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Mike_H over 18 years ago

Please post some logs and what you are trying to do with the DNAT rule.
Is it working?
Packets will always get dropped by the default drop rule if you do not define a rule for them
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 switch555 over 18 years ago in reply to Mike_H

There is dnat,snat, packetfilter rules. I have ~20 servers and all works fine except some packets are dropped. And there is some problem with one service on one server. I believe its bad packets but I have somehow to prove that its not firewall fault that service is not running. OK some logs:


 2007:01:29-08:56:12 (none) ulogd[2432]: ACCEPT: IN=eth3 OUT=eth1 MAC=00:11:0a:5c:cc:3f:00:02:85:13:ea:40:08:00  SRC=out.sid.e.ext DST=192.168.1.22 LEN=60 TOS=00 PREC=0x00 TTL=118 ID=48714 CE DF PROTO=TCP SPT=4256 DPT=135 SEQ=1528267553 ACK=0 WINDOW=65535 SYN URGP=0 

2007:01:29-08:58:50 (none) ulogd[2432]: DROP: IN=eth3 OUT= MAC=00:11:0a:5c:cc:3f:00:02:85:13:ea:40:08:00  SRC=out.sid.e.ext DST=ext.ern.al.ip LEN=40 TOS=00 PREC=0x00 TTL=119 ID=58678 CE DF PROTO=TCP SPT=1807 DPT=135 SEQ=272622639 ACK=2071558042 WINDOW=64871 ACK FIN URGP=0 

2007:01:29-08:58:51 (none) ulogd[2432]: DROP: IN=eth3 OUT= MAC=00:11:0a:5c:cc:3f:00:02:85:13:ea:40:08:00  SRC=out.sid.e.ext DST=ext.ern.al.ip LEN=40 TOS=00 PREC=0x00 TTL=119 ID=58685 CE DF PROTO=TCP SPT=1807 DPT=135 SEQ=272622639 ACK=2071558042 WINDOW=64871 ACK FIN URGP=0 

2007:01:29-08:58:54 (none) ulogd[2432]: DROP: IN=eth3 OUT= MAC=00:11:0a:5c:cc:3f:00:02:85:13:ea:40:08:00  SRC=out.sid.e.ext DST=ext.ern.al.ip LEN=40 TOS=00 PREC=0x00 TTL=119 ID=58707 CE DF PROTO=TCP SPT=1807 DPT=135 SEQ=272622639 ACK=2071558042 WINDOW=64871 ACK FIN URGP=0 

2007:01:29-08:59:00 (none) ulogd[2432]: DROP: IN=eth3 OUT= MAC=00:11:0a:5c:cc:3f:00:02:85:13:ea:40:08:00  SRC=out.sid.e.ext DST=ext.ern.al.ip LEN=40 TOS=00 PREC=0x00 TTL=119 ID=58799 CE DF PROTO=TCP SPT=1807 DPT=135 SEQ=272622639 ACK=2071558042 WINDOW=64871 ACK FIN URGP=0 

2007:01:29-08:59:10 (none) ulogd[2432]: DROP: IN=eth3 OUT= MAC=00:11:0a:5c:cc:3f:00:02:85:13:ea:40:08:00  SRC=out.sid.e.ext DST=ext.ern.al.ip LEN=40 TOS=00 PREC=0x00 TTL=119 ID=58803 CE DF PROTO=TCP SPT=1807 DPT=135 SEQ=272622639 ACK=2071558042 WINDOW=64871 ACK FIN URGP=0 

2007:01:29-08:59:31 (none) ulogd[2432]: DROP: IN=eth3 OUT= MAC=00:11:0a:5c:cc:3f:00:02:85:13:ea:40:08:00  SRC=out.sid.e.ext DST=ext.ern.al.ip LEN=40 TOS=00 PREC=0x00 TTL=119 ID=58860 CE DF PROTO=TCP SPT=1807 DPT=135 SEQ=272622639 ACK=2071558042 WINDOW=64871 ACK FIN URGP=0 

2007:01:29-09:02:54 (none) ulogd[2432]: ACCEPT: IN=eth3 OUT=eth1 MAC=00:11:0a:5c:cc:3f:00:02:85:13:ea:40:08:00  SRC=out.sid.e.ext DST=192.168.1.22 LEN=48 TOS=00 PREC=0x00 TTL=118 ID=59925 CE DF PROTO=TCP SPT=4207 DPT=135 SEQ=1866413855 ACK=0 WINDOW=65535 SYN URGP=0 

2007:01:29-09:30:23 (none) ulogd[2432]: DROP: IN=eth3 OUT= MAC=00:11:0a:5c:cc:3f:00:02:85:13:ea:40:08:00  SRC=out.sid.e.ext DST=ext.ern.al.ip LEN=52 TOS=00 PREC=0x00 TTL=119 ID=18794 DF PROTO=TCP SPT=1936 DPT=135 SEQ=2497111109 ACK=3902224449 WINDOW=64871 ACK FIN URGP=0 

2007:01:29-09:30:24 (none) ulogd[2432]: DROP: IN=eth3 OUT= MAC=00:11:0a:5c:cc:3f:00:02:85:13:ea:40:08:00  SRC=out.sid.e.ext DST=ext.ern.al.ip LEN=52 TOS=00 PREC=0x00 TTL=119 ID=18825 DF PROTO=TCP SPT=1936 DPT=135 SEQ=2497111109 ACK=3902224449 WINDOW=64871 ACK FIN URGP=0 

2007:01:29-09:30:26 (none) ulogd[2432]: DROP: IN=eth3 OUT= MAC=00:11:0a:5c:cc:3f:00:02:85:13:ea:40:08:00  SRC=out.sid.e.ext DST=ext.ern.al.ip LEN=52 TOS=00 PREC=0x00 TTL=119 ID=18895 DF PROTO=TCP SPT=1936 DPT=135 SEQ=2497111109 ACK=3902224449 WINDOW=64871 ACK FIN URGP=0 

2007:01:29-09:30:32 (none) ulogd[2432]: DROP: IN=eth3 OUT= MAC=00:11:0a:5c:cc:3f:00:02:85:13:ea:40:08:00  SRC=out.sid.e.ext DST=ext.ern.al.ip LEN=52 TOS=00 PREC=0x00 TTL=119 ID=19036 DF PROTO=TCP SPT=1936 DPT=135 SEQ=2497111109 ACK=3902224449 WINDOW=64871 ACK FIN URGP=0 

2007:01:29-09:30:42 (none) ulogd[2432]: DROP: IN=eth3 OUT= MAC=00:11:0a:5c:cc:3f:00:02:85:13:ea:40:08:00  SRC=out.sid.e.ext DST=ext.ern.al.ip LEN=52 TOS=00 PREC=0x00 TTL=119 ID=19296 DF PROTO=TCP SPT=1936 DPT=135 SEQ=2497111109 ACK=3902224449 WINDOW=64871 ACK FIN URGP=0 

2007:01:29-09:31:03 (none) ulogd[2432]: DROP: IN=eth3 OUT= MAC=00:11:0a:5c:cc:3f:00:02:85:13:ea:40:08:00  SRC=out.sid.e.ext DST=ext.ern.al.ip LEN=52 TOS=00 PREC=0x00 TTL=119 ID=19834 DF PROTO=TCP SPT=1936 DPT=135 SEQ=2497111109 ACK=3902224449 WINDOW=64871 ACK FIN URGP=0 

2007:01:29-09:33:53 (none) ulogd[2432]: ACCEPT: IN=eth3 OUT=eth1 MAC=00:11:0a:5c:cc:3f:00:02:85:13:ea:40:08:00  SRC=out.sid.e.ext DST=192.168.1.22 LEN=60 TOS=00 PREC=0x00 TTL=54 ID=54201 CE DF PROTO=TCP SPT=48686 DPT=135 SEQ=3793044673 ACK=0 WINDOW=5840 SYN URGP=0 

2007:01:29-09:42:53 (none) ulogd[2432]: ACCEPT: IN=eth3 OUT=eth1 MAC=00:11:0a:5c:cc:3f:00:02:85:13:ea:40:08:00  SRC=out.sid.e.ext DST=192.168.1.22 LEN=60 TOS=00 PREC=0x00 TTL=54 ID=44677 CE DF PROTO=TCP SPT=48930 DPT=135 SEQ=66307261 ACK=0 WINDOW=5840 SYN URGP=0 

2007:01:29-09:43:07 (none) ulogd[2432]: ACCEPT: IN=eth3 OUT=eth1 MAC=00:11:0a:5c:cc:3f:00:02:85:13:ea:40:08:00  SRC=out.sid.e.ext DST=192.168.1.22 LEN=60 TOS=00 PREC=0x00 TTL=118 ID=41898 CE DF PROTO=TCP SPT=4351 DPT=135 SEQ=1073617955 ACK=0 WINDOW=65535 SYN URGP=0 

2007:01:29-10:38:51 (none) ulogd[2432]: ACCEPT: IN=eth3 OUT=eth1 MAC=00:11:0a:5c:cc:3f:00:02:85:13:ea:40:08:00  SRC=out.sid.e.ext DST=192.168.1.22 LEN=60 TOS=00 PREC=0x00 TTL=54 ID=14400 DF PROTO=TCP SPT=50380 DPT=135 SEQ=3600855449 ACK=0 WINDOW=5840 SYN URGP=0 

2007:01:29-11:35:32 (none) ulogd[2432]: ACCEPT: IN=eth3 OUT=eth1 MAC=00:11:0a:5c:cc:3f:00:02:85:13:ea:40:08:00  SRC=out.sid.e.ext DST=192.168.1.22 LEN=60 TOS=00 PREC=0x00 TTL=118 ID=27099 DF PROTO=TCP SPT=4486 DPT=135 SEQ=566725641 ACK=0 WINDOW=65535 SYN URGP=0

SRC=out.sid.e.ext = client who is trying to connect to server.
ext.ern.al.ip = additional ip to external interface
192.168.1.22 = server ip

I do dnat and snat rules

Chain USR_OUTPUT (1 references)

 pkts bytes target     prot opt in     out     source               destination  

    0     0 DNAT       all  --  *      *       0.0.0.0/0            ext.ern.al.ip     to:192.168.1.22



Chain USR_POST (1 references)

 pkts bytes target     prot opt in     out     source               destination         

    7   336 SNAT       all  --  *      *       192.168.1.22         0.0.0.0/0           to:ext.ern.al.ip



Chain USR_PRE (1 references)

 pkts bytes target     prot opt in     out     source               destination

  320 26437 DNAT       all  --  *      *       0.0.0.0/0           ext.ern.al.ip      to:192.168.1.22

packet filter


Chain USR_FORWARD (1 references)

 pkts bytes target     prot opt in     out     source               destination  

    0     0 LOGACCEPT  all  --  *      *       0.0.0.0/0         192.168.1.22