LVS
lvs-users
Google
 
Web LinuxVirtualServer.org

Re: [lvs-users] TCP Connection Sync Problems RHEL

To: lvs-users@xxxxxxxxxxxxxxxxxxxxxx
Subject: Re: [lvs-users] TCP Connection Sync Problems RHEL
From: Lloyd Brown <lloyd_brown@xxxxxxx>
Date: Wed, 30 Jul 2014 08:35:43 -0600
On 07/30/2014 01:44 AM, Frank Kirschner wrote:
> Lloyd,
> 
> hmm, it's senseless doubled but please can you try out what happens if you
> add on 1st line:
> 
> # /sbin/iptables -I INPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
> # /sbin/service iptables save


Frank,

I can try it, but I'm not sure what you're expecting to see.  I have a
working setup, so without understanding what you're expecting to happen,
I'm not sure what to look for.

And there is already this one in the stock setup:

> -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

While it's not exactly the same, the only difference would be the "NEW"
flag.  I'm not sure what benefit that would be, other than accepting all
new connections (if I'm understanding the flag correctly).  While this
would probably work for at least some of the stuff I'm doing, it seems
excessively open.  I could also flush all the tables (iptables -F), and
get it working, but it doesn't mean I want to leave my server quite so
open and unprotected.



> 
> Do you have any OUTPUT rules in your iptables set?

Nope.  I've checked all 4 tables (raw, mangle, nat, filter) that I can
find that have an OUTPUT chain, and there doesn't seem to be anything in
any of them.  I certainly hadn't done it on purpose, and it doesn't seem
to be a part of the stock RHEL setup.


> After disabeling SeLINUX do you have reboot the system?

Yes.  You do need to reboot to disable SELinux.  And I did.  And it
didn't have any effect, as far as I could tell.

> 
> hope that helps,
> best regards
> Frank

_______________________________________________
Please read the documentation before posting - it's available at:
http://www.linuxvirtualserver.org/

LinuxVirtualServer.org mailing list - lvs-users@xxxxxxxxxxxxxxxxxxxxxx
Send requests to lvs-users-request@xxxxxxxxxxxxxxxxxxxxxx
or go to http://lists.graemef.net/mailman/listinfo/lvs-users

<Prev in Thread] Current Thread [Next in Thread>