Lately we have been having several routers that appear to be reseting our HTTP or SSH requests to connect to them from certain IP addresses. These services have all worked in the past, but one day with nothing changing on the router or on our end, they stop working. What makes this weird is that there are no block rules at all set up for these IP addresses, and in fact they these IP addresses are explicitly allowed to connect to the router for these services. When we look at the firewall, the accept rules are hit, and none of the reject rules are when the request happens, but it appears the router resets the connection, causing the service not to work. We have tried to reboot these routers, but they still continue to do this. They work fine from other IP addresses that we control as well, that are set up with the same address list to accept requests from.
We are running 4.5 on most of our boxes at the moment. Has anyone ever run into something like this, and if so how did you fix it?
Any chance that other rules further above match packets further down the connection, and can you post your entire ruleset?
Have you tried taking such a problematic IP address and adding explicit accept rules (two, one for src-address, one for dst-address) at the very top of the ruleset?
Nope, there’s nothing else there that would match the connection further down. I’ve looked for that, and only the explicit accept rules increment. Here are the filter rules.
I just tried putting an accept rule on the input chain for that IP as the src-address, as well as an accept rule on the output chain with that as the dst-address with the same result as before. When I do wget from a server that is tring to grab some graphs off of the router, it reports back that the connection has been reset by peer. When I try SSH to a router that is doing this to our office IP, PuTTY just says server closed the connection. So I’m guessing it is doing the same thing.
Huh. Based on that, a couple more questions: what IP address do example devices that get blocked have? Can you post your address lists, particularly the “Allowed IPs” list?
Have you checked that the IPs of the blocked devices didn’t somehow make it on to one of the dynamically populated address lists, such as “ssh_blacklist” or “abuse”? They might not be in there now, so check within the list timeout limits after an observed failure.
Beyond that, maybe contact support. I don’t see anything at all in that ruleset that would prevent access once you’ve ruled out the above.
I’ve checked and our IP addresses are not in any of the dynamic lists at all. I have a subnet defined for the Known IP addresses and all of our IP addresses are within those ranges. It’s something that I have been scratching my head about lately, it’s not just one box doing it but a couple of them, mostly with ssh. Just a client noticed an issue today when they were trying to grap one of the graphs off of the router.
I’ll get something sent up to support to see what they have to say.