/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */ Keywords: stops, hangs, dies We're getting strange firewall freezes for certain machines at random times. We've been using IPCHAINS for only a few months (I set it up to use Ian Hall-Beyer's IPCHAINS-FIREWALL script) and it's been trouble ever since. (With our old machine, we were running ipfwadm and never had these sort of problems -- just another problem due to time-outs of masqueraded connections.) At first, I thought it was the NIC. Then, I thought it was the switch. Now, I think it has something to do with IPCHAINS and its masquerading and filtering. Here's the symptom. One of the users within the firewall has an SSH connection and an XEmacs connection (running on Linux RedHat 6.1). His connection will freeze. From my computer (running Debian GNU/Linux), I can reach the firewall machine (via SSH) with no problem. From the firewall machine (10.1.1.1), when I try ping-ing his computer, it says: >From firewall (10.1.1.1): Destination Host Unreachable After about 1 minute, pings suddenly start working, but the connection remains frozen for about 1 minute. After that, his connection unfreezes and packets go through fine. I did an "ipchains -n -M -L" and saw his connection stayed up through the whole ordeal. Also, very strangely, the freezing problem seems to go away immediately when I unplug the patch cable and plug it back in. (That's why I thought it was a hardware problem at first.) I disabled the "ip_masq_portfw" and "ip_masq_autofw" modules, in case that was the problem. The modifications I made to the Ian Hall-Beyer's original IPCHAINS-FIREWALL script seemed rudimentary: 1) Changed LOCALIF from "ppp0" to "eth1". 2) Changed INTERNALNET to "10.1.1.0/24". 3) Changed the timeouts to $IPCHAINS -M -S 61200 0 7200 just before the "-j MASQ" stuff. 4) Enabled the "$IPCHAINS . . . LOCALNET 22" line to allow SSH connections. 5) Enabled the "$IPCHAINS . . . LOCALNET 113" line to allow identd connections. (I needed #3 due to our back-up software.) Sophisticated masqueraded network connections like RealAudio and IRC all work fine most of the time. The firewall machine is running Linux RedHat 6.1, which is 2.2.14-5.0 of the kernel. Anyone have any ideas how to stop this freezing problem? -- Robert Brown | Links2Go/Continuum Software, Inc. Programmer | 800 West Cummings Park, Ste 2900 mailto:[EMAIL PROTECTED] | Woburn, MA 01801-6504 voice: 781-932-8400 x100 | fax: 781-932-2558 _______________________________________________ Masq maillist - [EMAIL PROTECTED] Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES UNSUBSCRIBING! or email to [EMAIL PROTECTED] PLEASE read the HOWTO and search the archives before posting. You can start your search at http://www.indyramp.com/masq/ Please keep general linux/unix/pc/internet questions off the list.
