This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Another ACK RST dropping question

I've read a number of threads on here so far, but none address my concern.

There is a user here who is trying to access his university's online library. The university proxies their access to different databases through their University login.

All databases are working except for one at proquest.com. Looking at the firewall logs I see the following:

14:39:48	Default DROP TCP 134.117.10.200:80 →	10.0.0.63:61865 [ACK RST] len=40 ttl=46 tos=0x00 srcmac=0:32:59:ac:56:9d

I have created any rules to that IP and to the DNS host as well as from them. No luck. I've tried a DNAT and an SNAT rule with no avail.

I want to allow this connection. It works fine on DMZ, but not on my LAN. Also, This LAN only has Firewall and IPS activated. No Web Filtering.

Thanks!

This thread was automatically locked due to age.

0 BarryG over 12 years ago

Hi,

1. is that the only relevant firewall log entry?

2. anything in the IPS log?

3. what happens in the browser?

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 Astaronator over 12 years ago

1. I have looked everywhere else I can think of.

2. No IPS logs

3. The browser hangs. Doesn't give up. I'll let it run as long as possible and see if an error message appears ever or if it just keeps trying. I know it will last at least 5 minutes.
Cancel
Vote Up 0 Vote Down

Cancel
0 Astaronator over 12 years ago

My mistake... I searched the wrong IP in the IPS logs yesterday. Did another search and found that it was blocking.

Yesterday I had tried an exception to allow FROM that DNS host, but had no luck.

Just now I tried adding TO that DNS host and now it works perfectly.

Thanks for your help Barry!
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 12 years ago

Hi, could you post the IPS log entries? I'm curious as to which rule was triggering.

Barry
Cancel
Vote Up 0 Vote Down

Cancel