Hey there folks,
We're running into an issue with our LDAP servers where legitimate
packets are being intermittently (say 1/10000) rejected by iptables.
They match one of our ACCEPT rules, yet still get rejected (we're seeing
the return ICMP traffic).
I don't yet have any evidence to support this, but I'm thinking that
we're bumping up against some sort of internal netfilter limit--perhaps
with connection tracking or stateful matching.
The problem seems to have cropped up in moving from RHEL 5 to RHEL 6.
The rules in question:
What should be hit:
-A RH-Firewall-1-INPUT -s 129.64.0.0/255.255.0.0 -p tcp -m state --state
NEW -m tcp --dport 636 -j ACCEPT
What is actually being hit:
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
Anyone run into this sort of problem before?
John
--
John Miller
Systems Engineer
Brandeis University
[email protected]
_______________________________________________
bblisa mailing list
[email protected]
http://www.bblisa.org/mailman/listinfo/bblisa
