[Security-Discuss] iptable problems

Hi!

I have the following problem with my firewall begining with Mandriva
10.2:

My firewall (ICMP are not blocked to and from the host www):

..
iptables -A FORWARD  -s $INTERN_NET -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
..
iptables -A FORWARD -m state --state NEW -p tcp -d www --dport www-http -j ACCEPT
..
iptables -A FORWARD -s holm.homelinux.org  -j LOG --log-level $LOG_LEVEL --log-tcp-sequence --log-ip-options --log-prefix "HOLM:"
iptables -A FORWARD -p tcp  -j REJECT
..

So, as you can see this provides full acces to host www port 80.
The last 2 lines above should never be reached for a packet to www port 80.

This works correctly unitil (incl) 2.6.8.1-26mdksmp
Newer kernel versions 10.2, 2006, cooker with 2.6.16-1mdksmp  behaves different

If the client of the webserver are on a slow net, or on a net with
traffic shaping the last 2 lines are REACHED. Sometimes!
This means: some valid packets (with correct seq-no) of an established
connection (there IS an entry in /proc/net/ip_conntrack) are NOT recognized!

The effect: transfer of big files (eg. PDF) somtimes hangs, sometime
not.

Assuming that Iam not missing some relevant infos about changes in 
connection tracking handling, this seems to me a bug in the connection
tracking module. 
I'm now using 2.6.8.1-26mdksmp on my 2006.0 firewall without any problems.

Anyone on the net that observe the same effects on tranfering big
files or lost ssh connections?
Any ideas what's going on here?

mfg,jh

-- 
##----------------- IT Physik / Universitaet Goettingen --------------
## Tel:      +49 551 399363                      FAX:  +49 551 399263
## Post:     Dr. J. A. Holm  /  Friedrich Hund Platz 1  /  37077 Goettingen
## PGP-Key:  http://www.Theorie.Physik.Uni-Goe.de/jh.html
## In case of mail-probs (Anti-SPAM-conf) mail to jholm-2/[email protected]
##------------ Verschtehen Sie, Isch habe garrr kein Wooerd! ---------

____________________________________________________
Want to buy your Pack or Services from Mandriva? 
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________