Hi!
We have a very strange Shorewall Problem at our site. We're using a 1to1
NAT setup for an HPC cluster (250 nodes). It is running fine, but
sometimes established connections are stalling. We debugged several
connections with tcpdump and found out that on the WAN interface of our
gateway there are packages with duplicate ACKs which we can't find on the
internal interface of the gateway. The duplicate ACKs are probably send
due to delayed or lost packages. As the duplicate ACKs are not delivered
to the nodes behind the firewall, the connection stalls after a while.
Unfortunately, we can't find the reason, why shorewall / iptables is
blocking the packages with duplicate ACKs. Can anyone give us a hint how
to solve/further debug this problem?
/sbin/shorewall version
4.4.15.1
ip addr show
ip route show
shorewall show
-> see attachments
Cheers,
Florian Feldhaus
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
inet 127.0.0.2/8 brd 127.255.255.255 scope host secondary lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP
qlen 1000
link/ether 00:18:fe:2e:e1:f9 brd ff:ff:ff:ff:ff:ff
inet 10.129.0.7/16 brd 10.129.255.255 scope global eth0
inet6 fe80::218:feff:fe2e:e1f9/64 scope link
valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
link/ether 00:18:fe:2e:e1:f8 brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
link/ether 00:1c:c4:59:2b:3e brd ff:ff:ff:ff:ff:ff
inet 10.130.0.7/16 brd 10.130.255.255 scope global eth2
inet6 fe80::21c:c4ff:fe59:2b3e/64 scope link
valid_lft forever preferred_lft forever
5: eth3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
link/ether 00:18:fe:2e:e1:fb brd ff:ff:ff:ff:ff:ff
6: eth4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
link/ether 00:18:fe:2e:e1:fa brd ff:ff:ff:ff:ff:ff
7: eth5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
link/ether 00:1c:c4:59:2b:3c brd ff:ff:ff:ff:ff:ff
inet 129.217.240.1/21 brd 129.217.247.255 scope global eth5
inet 129.217.240.3/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.4/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.5/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.6/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.7/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.8/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.9/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.10/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.11/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.12/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.13/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.14/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.15/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.16/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.17/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.18/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.19/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.20/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.21/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.22/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.23/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.24/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.25/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.26/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.27/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.28/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.29/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.30/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.31/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.32/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.33/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.34/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.35/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.36/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.37/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.38/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.39/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.40/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.41/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.42/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.43/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.44/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.45/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.46/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.47/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.48/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.49/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.50/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.51/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.52/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.53/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.54/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.55/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.56/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.57/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.58/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.59/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.60/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.61/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.62/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.63/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.64/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.65/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.66/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.67/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.68/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.69/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.70/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.71/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.72/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.73/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.74/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.75/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.76/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.77/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.78/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.79/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.80/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.81/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.82/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.83/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.84/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.85/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.86/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.87/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.88/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.89/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.90/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.91/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.92/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.93/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.94/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.95/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.96/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.97/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.98/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.99/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.100/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.101/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.102/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.103/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.104/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.105/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.106/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.107/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.108/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.109/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.110/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.111/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.112/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.113/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.114/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.115/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.116/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.117/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.118/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.119/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.120/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.121/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.122/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.123/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.124/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.125/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.126/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.127/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.128/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.129/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.130/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.131/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.132/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.133/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.134/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.135/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.136/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.137/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.138/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.139/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.140/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.141/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.142/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.143/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.144/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.145/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.146/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.147/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.148/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.149/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.150/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.151/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.152/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.153/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.154/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.155/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.156/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.157/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.158/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.159/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.160/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.161/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.162/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.163/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.164/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.165/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.166/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.167/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.168/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.169/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.170/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.171/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.172/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.173/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.174/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.175/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.176/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.177/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.178/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.179/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.180/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.181/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.182/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.183/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.184/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.185/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.186/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.187/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.188/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.189/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.190/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.191/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.192/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.193/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.194/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.195/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.196/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.197/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.198/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.199/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.200/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.201/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.202/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.203/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.204/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.205/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.206/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.207/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.208/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.209/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.210/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.211/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.212/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.213/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.214/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.215/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.216/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.217/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.218/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.219/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.220/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.221/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.222/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.223/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.224/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.225/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.226/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.227/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.228/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.229/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.230/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.231/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.232/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.233/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.234/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.235/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.236/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.237/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.238/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.239/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.240/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.241/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.242/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.243/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.244/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.245/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.246/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.247/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.248/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.249/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.250/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.251/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.252/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.253/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.254/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.240.255/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.241.77/21 brd 129.217.247.255 scope global secondary eth5
inet 129.217.241.69/21 brd 129.217.247.255 scope global secondary eth5
inet6 fe80::21c:c4ff:fe59:2b3c/64 scope link
valid_lft forever preferred_lft forever129.217.240.0/21 dev eth5 proto kernel scope link src 129.217.240.1
10.130.0.0/16 dev eth2 proto kernel scope link src 10.130.0.7
10.129.0.0/16 dev eth0 proto kernel scope link src 10.129.0.7
169.254.0.0/16 dev eth0 scope link
127.0.0.0/8 dev lo scope link
default via 129.217.247.254 dev eth5
Shorewall 4.4.15.1 filter Table at lido-gw11 - Tue Feb 22 13:37:16 CET 2011
Counters reset Wed Feb 16 10:54:58 CET 2011
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
19M 1430M dynamic all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID,NEW
34M 18G net2fw all -- eth5 * 0.0.0.0/0 0.0.0.0/0
29M 27G loc2fw all -- eth0 * 0.0.0.0/0 0.0.0.0/0
134K 10M ic2fw all -- eth2 * 0.0.0.0/0 0.0.0.0/0
830K 73M ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
0 0 Reject all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix `Shorewall:INPUT:REJECT:'
0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
6456K 365M dynamic all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID,NEW
5651M 7016G net_frwd all -- eth5 * 0.0.0.0/0 0.0.0.0/0
4185M 1574G loc_frwd all -- eth0 * 0.0.0.0/0 0.0.0.0/0
13358 838K ic_frwd all -- eth2 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
0 0 Reject all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix `Shorewall:FORWARD:REJECT:'
0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
9256K 7622M fw2net all -- * eth5 0.0.0.0/0 0.0.0.0/0
18M 31G fw2loc all -- * eth0 0.0.0.0/0 0.0.0.0/0
133K 10M fw2ic all -- * eth2 0.0.0.0/0 0.0.0.0/0
830K 73M ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain Drop (0 references)
pkts bytes target prot opt in out source destination
0 0 all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 reject tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:113 /* Auth */
0 0 dropBcast all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
icmp type 3 code 4 /* Needed ICMP types */
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
icmp type 11 /* Needed ICMP types */
0 0 dropInvalid all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
multiport dports 135,445 /* SMB */
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpts:137:139 /* SMB */
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
udp spt:137 dpts:1024:65535 /* SMB */
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0
multiport dports 135,139,445 /* SMB */
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:1900 /* UPnP */
0 0 dropNotSyn tcp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
udp spt:53 /* Late DNS Replies */
Chain Reject (5 references)
pkts bytes target prot opt in out source destination
21M 1512M all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 reject tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:113 /* Auth */
21M 1512M dropBcast all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
icmp type 3 code 4 /* Needed ICMP types */
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
icmp type 11 /* Needed ICMP types */
21M 1508M dropInvalid all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 reject udp -- * * 0.0.0.0/0 0.0.0.0/0
multiport dports 135,445 /* SMB */
0 0 reject udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpts:137:139 /* SMB */
0 0 reject udp -- * * 0.0.0.0/0 0.0.0.0/0
udp spt:137 dpts:1024:65535 /* SMB */
0 0 reject tcp -- * * 0.0.0.0/0 0.0.0.0/0
multiport dports 135,139,445 /* SMB */
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:1900 /* UPnP */
98 53773 dropNotSyn tcp -- * * 0.0.0.0/0 0.0.0.0/0
33 2380 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
udp spt:53 /* Late DNS Replies */
Chain dropBcast (2 references)
pkts bytes target prot opt in out source destination
12552 4117K DROP all -- * * 0.0.0.0/0 0.0.0.0/0
ADDRTYPE match dst-type BROADCAST
0 0 DROP all -- * * 0.0.0.0/0 224.0.0.0/4
Chain dropInvalid (2 references)
pkts bytes target prot opt in out source destination
21M 1507M DROP all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID
Chain dropNotSyn (2 references)
pkts bytes target prot opt in out source destination
98 53773 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp flags:!0x17/0x02
Chain dynamic (2 references)
pkts bytes target prot opt in out source destination
0 0 logdrop all -- * * 129.217.240.3 0.0.0.0/0
Chain fw2ic (1 references)
pkts bytes target prot opt in out source destination
133K 10M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
1 60 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain fw2loc (1 references)
pkts bytes target prot opt in out source destination
18M 31G ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
2683 168K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain fw2net (1 references)
pkts bytes target prot opt in out source destination
9224K 7620M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
32421 2806K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain ic2fw (1 references)
pkts bytes target prot opt in out source destination
1258 245K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
133K 10M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain ic2loc (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
2 120 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain ic2net (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
13356 838K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain ic_frwd (1 references)
pkts bytes target prot opt in out source destination
13356 838K ic2net all -- * eth5 0.0.0.0/0 0.0.0.0/0
2 120 ic2loc all -- * eth0 0.0.0.0/0 0.0.0.0/0
Chain loc2fw (1 references)
pkts bytes target prot opt in out source destination
29M 27G ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
563K 34M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain loc2ic (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain loc2net (1 references)
pkts bytes target prot opt in out source destination
4173M 1565G ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
3626K 215M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain loc_frwd (1 references)
pkts bytes target prot opt in out source destination
4176M 1565G loc2net all -- * eth5 0.0.0.0/0 0.0.0.0/0
8186K 8338M ACCEPT all -- * eth0 0.0.0.0/0 0.0.0.0/0
0 0 loc2ic all -- * eth2 0.0.0.0/0 0.0.0.0/0
Chain logdrop (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain logreject (0 references)
pkts bytes target prot opt in out source destination
0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0
Chain net2fw (1 references)
pkts bytes target prot opt in out source destination
15M 17G ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
4022 338K ACCEPT icmp -- * * 129.217.0.0/16 0.0.0.0/0
9338 628K ACCEPT tcp -- * * 129.217.0.0/16 0.0.0.0/0
tcp dpt:22
0 0 ACCEPT tcp -- * * 132.195.0.0/16 0.0.0.0/0
tcp dpt:22
19M 1385M Reject all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix `Shorewall:net2fw:REJECT:'
0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain net2ic (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
0 0 Reject all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix `Shorewall:net2ic:REJECT:'
0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain net2loc (1 references)
pkts bytes target prot opt in out source destination
5648M 7016G ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
2348 197K ACCEPT icmp -- * * 129.217.0.0/16 0.0.0.0/0
92 5612 ACCEPT tcp -- * * 129.217.0.0/16 0.0.0.0/0
tcp dpt:22
35524 2125K ACCEPT tcp -- * * 129.217.0.0/16 10.129.0.5
tcp dpt:80 ctorigdst 129.217.240.3
0 0 ACCEPT tcp -- * * 132.195.0.0/16 0.0.0.0/0
tcp dpt:22
0 0 ACCEPT tcp -- * * 132.195.0.0/16 10.129.0.5
tcp dpt:80 ctorigdst 129.217.240.3
90656 5440K ACCEPT tcp -- * * 0.0.0.0/0 10.129.24.2
multiport dports 2119,2222,20000:25000,8443,2811 ctorigdst
129.217.241.77
171K 10M ACCEPT tcp -- * * 0.0.0.0/0 10.129.24.3
multiport dports 2119,20000:25000,8443,2170,2811 ctorigdst
129.217.241.69
397 20184 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
multiport dports 2119,2135,2136,2170,2811,8443,20000:25000
3156 164K ACCEPT tcp -- * * 0.0.0.0/0 10.129.25.2
2433K 127M Reject all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix `Shorewall:net2loc:REJECT:'
0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain net_frwd (1 references)
pkts bytes target prot opt in out source destination
5651M 7016G net2loc all -- * eth0 0.0.0.0/0 0.0.0.0/0
0 0 net2ic all -- * eth2 0.0.0.0/0 0.0.0.0/0
Chain reject (12 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
ADDRTYPE match src-type BROADCAST
0 0 DROP all -- * * 224.0.0.0/4 0.0.0.0/0
0 0 DROP 2 -- * * 0.0.0.0/0 0.0.0.0/0
0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0
reject-with tcp-reset
0 0 REJECT udp -- * * 0.0.0.0/0 0.0.0.0/0
reject-with icmp-port-unreachable
0 0 REJECT icmp -- * * 0.0.0.0/0 0.0.0.0/0
reject-with icmp-host-unreachable
0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0
reject-with icmp-host-prohibited
Chain shorewall (0 references)
pkts bytes target prot opt in out source destination------------------------------------------------------------------------------
Index, Search & Analyze Logs and other IT data in Real-Time with Splunk
Collect, index and harness all the fast moving IT data generated by your
applications, servers and devices whether physical, virtual or in the cloud.
Deliver compliance at lower cost and gain new business insights.
Free Software Download: http://p.sf.net/sfu/splunk-dev2dev
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
