newnotsyn question

Jack Coates
Wed, 29 Dec 2004 23:28:11 -0000

Hi,

I''m running shorewall-2.0.8-1mdk with iptables-1.2.9-7.1.101mdk on
kernel-2.4.22-30mdk, Mandrake 10.1 (kernel-2.6.8.1.10mdk-1-1mdk is
installed, but I haven''t rebooted yet).

I get a significant number of newnotsyn packet denials from existing,
valid connections. Most of these seem to be on port 80 and port 25, and
directionality doesn''t seem to matter (I run public web and mail
services on the firewall).

Web and mail seem to work fine despite the drops, so it''s not enough to
actually stop TCP... I''m not sure if this is because of retransmits or
if the packets were never actually dropped, just logged as such. The
behavior is intermittent enough that it''s difficult to catch with
tethereal.

[jack@felix jack]$ sudo grep -rin newnotsyn /etc/shorewall/ | grep -v \#
/etc/shorewall/interfaces:128:inside    eth1    detect  newnotsyn
/etc/shorewall/interfaces:129:inside    eth2    detect  newnotsyn
/etc/shorewall/interfaces:130:inside    eth3    detect  newnotsyn
/etc/shorewall/shorewall.conf:147:LOGNEWNOTSYN=debug
/etc/shorewall/shorewall.conf:435:NEWNOTSYN=No

These three interfaces are the "inside" zone, eth0 is the Internet.

I haven''t found anything relevant by searching the shorewall.net
documentation, but I could certainly take a STFW pointer.

thanks,
--
Jack at Monkeynoodle dot Org: It''s a Scientific Venture...
Riding the Emergency Third Rail Power Trip since 1996!