Mailinglist Archive: opensuse-security (465 mails)

< Previous Next >
Re: [suse-security] Access to some webservers through firewall
  • From: Andreas Baetz <andreas.baetz@xxxxxxxx>
  • Date: Wed, 5 Dec 2001 08:28:56 +0100
  • Message-id: <01120508285601.10089@pp1>
On Monday 26 November 2001 10:31, Ralf Ronneburger wrote:
> Hello!
> I have configured my firewall with iptables to basically let in only
> answers on my requests, which works fine at about 95% of all webservers.
> But when I'm trying to access some sites my firewall blocks the answers
> like this:
> Nov 26 10:04:18 internet kernel: DROP-TCP IN=ppp0 OUT= MAC=
> SRC= DST= LEN=1490 TOS=0x00 PREC=0x00 TTL=54
> ID=8559 DF PROTO=TCP SPT=80 DPT=1789 WINDOW=15972 RES=0x00 ACK URGP=0
> which is correct, because I was trying to contact
> ( I think that they have a load balancer who sent me to
> that ip-address, but as my firewall did not open a connection there it
> blocks the packages.
> Any ideas what I can do about that? By the way, I had the same problem
> with suse-firewall, too.
> Best regards,
> Ralf Ronneburger

Sorry for the late reply, maybe your problem is solved already.
I suppose you're running pppoe (DSL) ?
There is a problem with pppoe with certain servers. Maybe this is what you are
experiencing, maybe something else:
With tcpdump you see the initial handshake between the client and the server,
the client request, but never the data sent by the server. When this is so in your
case, you could try the following:
1. compile your kernel to have netfilter tcpmss support.
2 insert a rule
"iptables -A FORWARD -j TCPMSS \
-p tcp --tcp-flags SYN,RST SYN --clamp-mss-to-pmtu"
3. set mtu=1492 and mru=1492 in /etc/pppd/options
4. restart pppd and firewall

If your problem is solved, I would like to know.

Andreas Baetz

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote also confirms that this email message has been scanned
for the presence of computer viruses.

< Previous Next >
This Thread
Follow Ups