This would explain the firewall receiving SYNACK packets that would trigger DROP_NEWNOTSYN and consequently the DROP_CTINVALID (connection absent in the conntrack table). This would suggest that the syn packets starts from behind the firewall but somehow they are not kept in account by the kernel. If the firewall was dropping these packets, a packet drop log entry would consistently appear, right?ĭo I understand correctly that curl from IPFire machine works and the problem happens only from behind the firewall? The weird thing is that tail -f /var/log/messages while attempting to curl -v yields no packet drop errors, making this very hard to debug, indeed. Did you figure out what the issue was? In my case, the only thing dropped that was to protonmail-connected IP addresses are some DROP_CTINVALID and DROP_NEWNOTSYN packets.
0 kommentar(er)
