Okay, I have a wierd problem and I've no idea where to start looking to fix it.
Bascially, when I start my firewall script everything loads fine and everything works. Machines on the network can access what the firewall allows them to and it is also denying illegal access and logging all correctly.

However, after about an hour (sometimes more or sometimes less), everything stops working. The machines on the network have no access to the firewall computer, yet I get nothing in the logs. If I unload the firewall rules and then load them again, everything works fine again for another hour or so.

I've never seen anything like this before, anyone have any ideas?

I am using Kernel 2.4.3 with iptables 1.2.2

Ok as it's an intermittent problem we need more info:

What does this tell you:
type:
sysctl -a | grep "net.ipv4.tcp_fin_timeout"

-----------
Next time it stops type:
netstat -na | grep tcp

also:
ifconfig -a
Do you have any overrun or errors on any of the NIC's ?

Try this for now.
I haven't seen iptables do this before.

Raz

This command: sysctl -a | grep "net.ipv4.tcp_fin_timeout"
gives me: net.ipv4.tcp_fin_timeout = 360

This command (while everthing is working): netstat -na |grep tcp
gives me:

tcp 0 0 0.0.0.0:2789 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:8200 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:139 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:10000 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 48 192.168.8.3:22 192.168.4.92:1105 ESTABLISHED


I'll have to redo that when the problem starts next.

I am getting no overrun errors on either nic.

Just on a side note......what would be the service that is causing port 8200 to be open??

Thanks Raz.

well, this strange phenomina seems to have stopped and to be perfectly honest I've no idea of what I did to correct the problem...

But oh well, it all seems to be working nicely now.

Good to know, I don't think it was anything I told you to do.
The timeout of 360 is correct.

anyway type:
netstat -natp | grep 8200
This will show you what service has started on this port.

/Raz

Thanks again Raz.

Your help is greatly appriciated.

Regards
Bomber