On 2/22/11 4:40 AM, [email protected] wrote: > We have a very strange Shorewall Problem at our site. We're using a 1to1 > NAT setup for an HPC cluster (250 nodes). It is running fine, but > sometimes established connections are stalling. We debugged several > connections with tcpdump and found out that on the WAN interface of our > gateway there are packages with duplicate ACKs which we can't find on the > internal interface of the gateway. The duplicate ACKs are probably send > due to delayed or lost packages. As the duplicate ACKs are not delivered > to the nodes behind the firewall, the connection stalls after a while. > Unfortunately, we can't find the reason, why shorewall / iptables is > blocking the packages with duplicate ACKs. Can anyone give us a hint how > to solve/further debug this problem?
This has nothing to do with Shorewall configuration. Please try
inserting this into /etc/shorewall/init and see if it helps:
echo 1 > /proc/sys/net/netfilter/nf_conntrack_tcp_be_liberal
-Tom
--
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Index, Search & Analyze Logs and other IT data in Real-Time with Splunk Collect, index and harness all the fast moving IT data generated by your applications, servers and devices whether physical, virtual or in the cloud. Deliver compliance at lower cost and gain new business insights. Free Software Download: http://p.sf.net/sfu/splunk-dev2dev
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
