Weird connection tracking behavior

jaykay2342 · Mon Dec 02, 2013 8:57 pm

I'm facing strange issues with connection tracking on a RB2011.

Running ROS 6.6

Connection Tracking is set to Auto.
I have no FW-rules at all. But it's still tracking connections.

/ip firewall connection tracking> print 
                   enabled: auto
      tcp-syn-sent-timeout: 5s
  tcp-syn-received-timeout: 5s
   tcp-established-timeout: 1d
      tcp-fin-wait-timeout: 10s
    tcp-close-wait-timeout: 10s
      tcp-last-ack-timeout: 10s
     tcp-time-wait-timeout: 10s
         tcp-close-timeout: 10s
               udp-timeout: 10s
        udp-stream-timeout: 3m
              icmp-timeout: 10s
           generic-timeout: 10m
               max-entries: 220920
             total-entries: 98

even if i'm turning off the tracking manual its showing total-entries.

anyone an idea which setting can cause such behavior?

/ip firewall connection tracking> print 
                   enabled: no
      tcp-syn-sent-timeout: 5s
  tcp-syn-received-timeout: 5s
   tcp-established-timeout: 1d
      tcp-fin-wait-timeout: 10s
    tcp-close-wait-timeout: 10s
      tcp-last-ack-timeout: 10s
     tcp-time-wait-timeout: 10s
         tcp-close-timeout: 10s
               udp-timeout: 10s
        udp-stream-timeout: 3m
              icmp-timeout: 10s
           generic-timeout: 10m
               max-entries: 220920
             total-entries: 104

On an other ROS device (RB750GL) here in my lab it behave like expected: only tracking as soon it has one enabled fw-rule. if i turn tracking manual off it shows 0 total-entries.

/ip firewall connection tracking print 
                   enabled: auto
      tcp-syn-sent-timeout: 5s
  tcp-syn-received-timeout: 5s
   tcp-established-timeout: 1d
      tcp-fin-wait-timeout: 10s
    tcp-close-wait-timeout: 10s
      tcp-last-ack-timeout: 10s
     tcp-time-wait-timeout: 10s
         tcp-close-timeout: 10s
               udp-timeout: 10s
        udp-stream-timeout: 3m
              icmp-timeout: 10s
           generic-timeout: 10m
               max-entries: 90968
             total-entries: 0

jaykay2342 · Tue Dec 03, 2013 7:23 pm

found reason my self. IPv6 fw-rules caused the tracking.

i just had some rules in the input chain to protect the router. it's sad that this cause the router to track

Weird connection tracking behavior

Weird connection tracking behavior

Re: Weird connection tracking behavior

Who is online