IPFILTER Question

[Marco Radzinschi]

On Tue, 1 Apr 2003, Nevins, Peter  wrote:

> Hello. I'm a firewall admin and have run into a question regarding your OS.
> A client is running IPFILTER and cannot send mail to us here. We're running
> a Raptor Firewall for NT (yes, NT). He sends a SYN and my system responds
> with an ACK that is more on the lines of 1 million in length over the
> expected 1024. His system drops the incoming packet from me thus no email
> transfer. Having no working knowledge of IPFILTER, I don't know if it's on
> my end or his. Do you have any previous problems noted where Raptor
> Firewalls are the common denominator?
>
> Thanks for any assistance you can provide in this. I have a TCPDUMP if you
> would like to see it or know of anyone who could help.
>
> Pete

We had the same problem.  That Raptor Firewall SMTP proxy has some sort of
spoofing protection which causes this.

You can get around it by adding the following rule to IPFilter. Place this
before any pass rules, and it should work.

block return-rst in on xl0 proto tcp from any to any

Marco Radzinschi
marco at radzinschi.com

"Among those who dislike oppression are
many who like to oppress." - Napoleon Bonaparte