[Xen-users] iptables and state matches (established, related)

["Andrey Oreshnikov" <elride@xxxxxxxxx>]

I use xen-3.0.4_1 ( linux-2.6.16.33 ) and have some promblem with it
and iptables. I installed both from source and from rpms for Suse. The
problem is in both.

The iptables state match don't work in INPUT and OUTPUT chains but
work in FORWARD chain. For example rule

iptables  -A INPUT -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT

don't match any packets in established connection.

Necessarily modules are loaded

# lsmod | grep conntrack
ip_conntrack_ftp       12144  1 ip_nat_ftp
ip_conntrack           58584  3 ip_nat_ftp,ip_nat,ip_conntrack_ftp
nfnetlink              10520  2 ip_nat,ip_conntrack

# cat /proc/net/ip_conntrack
tcp      6 186909 ESTABLISHED src=192.168.0.170 dst=192.168.0.124
sport=29664 dport=22 packets=1 bytes=52 [UNREPLIED] src=192.168.0.124
dst=192.168.0.170 sport=22 dport=29664 packets=0 bytes=0 mark=0 use=1

This rule work fine:

IPTABLES   -A FORWARD -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT

In xen-3.0.2 from sles distribution this problem is absent.
any suggestion?

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users