ipchains doesn't seem to honor -M -S

Marc MERLIN (marc_merlin@magic.metawire.com)
2 Oct 1998 23:53:21 GMT

With a 2.1.123 kernel, I did the following:

bernina:/etc/rc.d# ipchains -M -S 86400 60 120
bernina:/etc/rc.d# ipchains -M -L | grep TCP | grep magic
TCP 00:55.50 10.1.1.2 magic.magic.metawire.com 2543 (64623) -> uucp
TCP 06:12.12 10.1.1.2 magic.magic.metawire.com 2542 (64496) -> 22

I killed the ssh session here, and launched a new one

bernina:/etc/rc.d# ipchains -M -L | grep TCP | grep magic
TCP 00:34.58 10.1.1.2 magic.magic.metawire.com 2543 (64623) -> uucp
TCP 14:59.99 10.1.1.2 magic.magic.metawire.com 2548 (64653) -> 22
TCP 00:06.19 10.1.1.2 magic.magic.metawire.com 2542 (64496) -> 22

As you can see, neither the 60 seconds after the session close, nor the 24h
for each open TCP session are honored. This is obviously very annoying as it
means that all my ssh sessions to the outside die after 15mn of inactivity.

Back with 2.0.35, everything works fine:

bernina:~# cat /proc/net/ip_masquerade | grep TCP
TCP 0A010166:05BA 180147A0:0016 EE49 00000000 0 0 8613044
TCP 0A01016E:0612 C6511C02:1446 EE78 00000000 0 0 8639915
TCP 0A010166:05CB AB400F88:0017 EE9B 00000000 0 0 8613824

(I couldn't use ipfwadm -M -l because that machine still has the stupid
version that can't deal with ICMP masquerading).

Am I doing anything wrong? Is this a bug?

Thanks a lot,
Marc

-- 
Home page: http://magic.metawire.com/~merlin/ (browser friendly)
Finger merlin@magic.metawire.com for PGP key and other contact information


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/