Dropped packets logged which should be accepted by Conntrack

["John A. Sullivan III" <jsullivan@xxxxxxxxxxxxxxxxxxx>]

Hello, all.  I find myself perplexed by what I often see in our logs.
At the end of our FORWARD chain, we log drops for no matches:

[root@fw01 log]# iptables -v -n -L FORWARD
Chain FORWARD (policy DROP 528K packets, 85M bytes)
 pkts bytes target     prot opt in     out     source
destination
  16M  925M TCPMSS     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0           tcp flags:0x06/0x02 TCPMSS clamp to PMTU
2284M 1690G ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0           state RELATED,ESTABLISHED
7890K  594M VPN_ALLOW  all  --  *      *       0.0.0.0/0
0.0.0.0/0           MARK match 0xcccc/0xcccc
  27M 2609M UPEPIN_DENY  all  --  *      *       0.0.0.0/0
0.0.0.0/0
  27M 2609M UPEPIN     all  --  *      *       0.0.0.0/0
0.0.0.0/0
 528K   85M LOG        all  --  *      *       0.0.0.0/0
0.0.0.0/0           LOG flags 0 level 4 prefix `No Match: '

However, my logs are always showing these drops for packets I know
should be matched in conntrack:

Nov 14 18:45:51 fw01 kernel: No Match: IN=bond4 OUT=bond3 SRC=172.x.y.34
DST=194.187.105.194 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=48910 DF
PROTO=TCP SPT=25 DPT=60261 WINDOW=4
Nov 14 18:45:51 fw01 kernel: No Match: IN=bond1 OUT=bond4 SRC=172.x.z.73
DST=172.x.y.34 LEN=40 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP
SPT=389 DPT=55912 WINDOW=0 RES=0
Nov 14 18:45:51 fw01 kernel: No Match: IN=bond4 OUT=bond3 SRC=172.x.y.34
DST=115.68.20.245 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=63654 DF PROTO=TCP
SPT=25 DPT=35100 WINDOW=46
Nov 14 18:45:51 fw01 kernel: No Match: IN=bond4 OUT=bond3 SRC=172.x.y.34
DST=89.31.145.16 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=58184 DF PROTO=TCP
SPT=25 DPT=6654 WINDOW=46 RE
Nov 14 18:45:51 fw01 kernel: No Match: IN=bond4 OUT=bond3 SRC=172.x.y.34
DST=206.71.61.68 LEN=40 TOS=0x00 PREC=0x00 TTL=63 ID=48619 DF PROTO=TCP
SPT=25 DPT=2643 WINDOW=5840
Nov 14 18:45:51 fw01 kernel: No Match: IN=bond1 OUT=bond4 SRC=172.x.z.73
DST=172.x.y.34 LEN=40 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP
SPT=389 DPT=34623 WINDOW=0 RES=0
Nov 14 18:45:51 fw01 kernel: No Match: IN=bond1 OUT=bond4 SRC=172.x.z.73
DST=172.x.y.34 LEN=40 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP
SPT=389 DPT=34658 WINDOW=0 RES=0
Nov 14 18:45:51 fw01 kernel: No Match: IN=bond1 OUT=bond4 SRC=172.x.z.73
DST=172.x.y.34 LEN=40 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP
SPT=389 DPT=34684 WINDOW=0 RES=0
Nov 14 18:45:51 fw01 kernel: No Match: IN=bond1 OUT=bond4 SRC=172.x.z.73
DST=172.x.y.34 LEN=40 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP
SPT=11211 DPT=46880 WINDOW=0 RES
Nov 14 18:45:51 fw01 kernel: No Match: IN=bond1 OUT=bond4 SRC=172.x.z.73
DST=172.x.y.34 LEN=40 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP
SPT=389 DPT=34666 WINDOW=0 RES=0
Nov 14 18:45:52 fw01 kernel: No Match: IN=bond1 OUT=bond4 SRC=172.x.z.73
DST=172.x.y.34 LEN=40 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP
SPT=389 DPT=34657 WINDOW=0 RES=0
Nov 14 18:45:52 fw01 kernel: No Match: IN=bond1 OUT=bond4 SRC=172.x.z.73
DST=172.x.y.34 LEN=40 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP
SPT=389 DPT=34667 WINDOW=0 RES=0
Nov 14 18:45:52 fw01 kernel: No Match: IN=bond1 OUT=bond4 SRC=172.x.z.73
DST=172.x.y.34 LEN=40 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP
SPT=389 DPT=34636 WINDOW=0 RES=0
Nov 14 18:45:52 fw01 kernel: No Match: IN=bond1 OUT=bond4 SRC=172.x.z.73
DST=172.x.y.34 LEN=40 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP
SPT=389 DPT=34658 WINDOW=0 RES=0
Nov 14 18:45:52 fw01 kernel: No Match: IN=bond4 OUT=bond3 SRC=172.x.y.34
DST=64.34.234.107 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=8764 DF PROTO=TCP
SPT=25 DPT=48135 WINDOW=46 R
Nov 14 18:45:52 fw01 kernel: No Match: IN=bond1 OUT=bond4 SRC=172.x.z.73
DST=172.x.y.34 LEN=40 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP
SPT=389 DPT=34684 WINDOW=0 RES=0
Nov 14 18:45:52 fw01 kernel: No Match: IN=bond1 OUT=bond4 SRC=172.x.z.73
DST=172.x.y.34 LEN=40 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP
SPT=389 DPT=34666 WINDOW=0 RES=0
Nov 14 18:45:52 fw01 kernel: No Match: IN=bond4 OUT=bond3 SRC=172.x.y.34
DST=94.23.2.185 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=16465 DF PROTO=TCP
SPT=25 DPT=55897 WINDOW=46 RE
Nov 14 18:45:52 fw01 kernel: No Match: IN=bond4 OUT=bond3 SRC=172.x.y.34
DST=89.31.145.16 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=58185 DF PROTO=TCP
SPT=25 DPT=6654 WINDOW=46 RE

The above shows SMTP, LDAP, and memcached replies which should have been
accepted.  Why would I see this?

I thought that the conntrack table might be overrun since there is a
very large rule set.  However,

[root@fw01 log]# cat /proc/sys/net/ipv4/netfilter/ip_conntrack_count
534
[root@fw01 log]# cat /proc/sys/net/ipv4/netfilter/ip_conntrack_max
65536
[root@fw01 log]# cat /sys/module/nf_conntrack/parameters/hashsize
16384

So it looks like we are nowhere near the max number of conntrack
entries.  So, if conntrack is not overrun, why is it not matching these
packets? Thanks - John

--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html