| |
|
 |
|
 |
|
|
|
| |
|
|
xen-users
Re: [Xen-users] iptables and state matches (established, related)
On Tue, 10 Apr 2007, Andrey Oreshnikov wrote:
I use xen-3.0.4_1 ( linux-2.6.16.33 ) and have some promblem with it and
iptables. I installed both from source and from rpms for Suse. The
problem is in both.
The iptables state match don't work in INPUT and OUTPUT chains but work
in FORWARD chain. For example rule
iptables -A INPUT -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT
don't match any packets in established connection.
Necessarily modules are loaded
# lsmod | grep conntrack
ip_conntrack_ftp 12144 1 ip_nat_ftp
ip_conntrack 58584 3 ip_nat_ftp,ip_nat,ip_conntrack_ftp
nfnetlink 10520 2 ip_nat,ip_conntrack
# cat /proc/net/ip_conntrack
tcp 6 186909 ESTABLISHED src=192.168.0.170 dst=192.168.0.124 sport=29664
dport=22 packets=1 bytes=52 [UNREPLIED] src=192.168.0.124
dst=192.168.0.170 sport=22 dport=29664 packets=0 bytes=0 mark=0 use=1
This rule work fine:
IPTABLES -A FORWARD -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT
In xen-3.0.2 from sles distribution this problem is absent. any
suggestion?
I can confirm the problem Andrey is describing.
When I try to connect to an external host, the "SYN_SENT" state does not
show up in /proc/net/ip_conntrack and the SYN+ACK packet from the external
host is dropped. (The "SYN_SENT" state is what allows the iptables
"ESTABLISHED" match to occur.)
Before starting XEN (and the briding) it works with the same iptables
rules. (See rules below)
I'm not sure this really has anything to do with XEN, but rather how the
bridging works, but I "hope" that other people on this list has the same
problem, and possibly someone has even found a solution?
Sample commands to reproduce the problem:
iptables -F
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -j DROP
telnet [host] [port]
//tlund
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users
|
|
|
| |
|
Home