ipf loosing state on reipf

[Richard van den Berg]

I just replaced Checkpoint FW-1 NG with ipf 3.4.30. (I will this upgrade to 3.4.31 soon.) Rewriting the rules to ipf.conf was quite easy using ipfmeta. Needless to say performance of the firewall is way up now. :-)

I have one annoyancce left. When I issue "/etc/init.d/ipfboot reipf" some of my open connections hang. This should not happen because the state tables are not flushed (ipf -Fa is used).

State entry just before the reipf:

192.168.2.12 -> 212.238.176.190 ttl 171858 pass 0x580a pr 6 state 4/4
pkts 80 bytes 8586 44798 -> 22 5c2b950b:6c30e4d5 24820<<0:8760<<0
pass in quick keep frags keep state IPv4
pkt_flags & 2(b2) = b, pkt_options & ffffffff = 0
pkt_security & ffff = 0, pkt_auth & ffff = 0
interfaces: in qfe1,qfe1 out qfe1,qfe0

State entry just after the reipf:

192.168.2.12 -> 212.238.176.190 ttl 171819 pass 0x580a pr 6 state 4/4
pkts 80 bytes 8586 44798 -> 22 5c2b950b:6c30e4d5 24820<<0:8760<<0
pass in quick keep frags keep state IPv4
pkt_flags & 2(b2) = b, pkt_options & ffffffff = 0
pkt_security & ffff = 0, pkt_auth & ffff = 0
interfaces: in qfe1,qfe1 out qfe1,qfe0

But then why is this packet blocked:

Feb 4 10:54:55 blackhole ipmon[155]: [ID 702911 local0.warning] 10:54:55.077677 qfe0 @30:10 b x.y.2.12,44798 -> v.w.176.190,22 PR tcp len 20 60 -AP IN

This is an SSH session from our internal network to our DMZ, without any NAT. The matching rule is:

pass in quick proto tcp from any to any flags S keep state keep frags

If I remove the "flags S" everything works fine after the "reipf" .. why?

Note that other connections (on other interfaces) do stay up after the reipf.. but I cannot find any differences in the rules for that interface.

Any thoughts?

Sincerely,

Richard van den Berg

PS: please Cc me .. I am not on this list