Hello,
I have a web server with apache+modproxy running FreeBSD 7.2-RELEASE-p7.
I filter incoming and outgoing traffic with pf.
I have some packets (about 20 per day) which are blocked and I don't understand
why.
My config is :
Internet -> ServerA(modproxy) -> ServerB(apache).
Here is the log for one blocked packet :
2010-03-02 15:40:29.573890 rule 7/0(match): block out on le0: serverA.62228 >
serverB.80: F 3525425568:3525425568(0) ack 459935989 win 8326 <nop,nop,timestamp
9801116 1193432194>
All logs are similar.
Rule 7 is :
block return out log all
I have a rule allowing the traffic towards serverB :
pass out quick on le0 inet proto tcp from serverA to serverB port = http
As the packet has the FIN flag, I change this rule to :
pass out quick on le0 inet proto tcp from serverA to serverB port = http flags
S/SA keep state (if-bound, tcp.finwait 90)
but it doesn't change anything.
I used tcpdump to dump all traffic between the 2 servers, and the conversation
outgoing from port 62228 (shown in the log of the blocked packet) ended at
15h22, and the packet is block at 15h40.
I guess there is something I mis-understood, but I don't know what.
Could you help me understand ?
Best regards,
--
Olivier THIBAULT
Université François Rabelais - UFR Sciences et Techniques
Laboratoire de Mathématiques et Physique Théorique (UMR CNRS 6083)
Service Informatique de l'UFR
Parc de Grandmont
37200 Tours - France
Email: olivier.thibault at lmpt.univ-tours.fr
Tel: (33)(0)2 47 36 69 12
Fax: (33)(0)2 47 36 70 68
Mobile : (33)(0)6 62 60 80 44
_______________________________________________
freebsd-pf@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to "freebsd-pf-unsubscr...@freebsd.org"
