Grokbase
Topics Posts Groups | in
x
[ help ]

Re: iptables starts blocking outbound http traffic

View PostFlat  Thread  Threaded | < Prev - Next >
Filipe Brandenburger Re: [CentOS] iptables starts blocking outbound http traffic
| +1 vote
[ Profile | Reply to group ] [ Flat  Thread  Threaded ]
Hi,

On Wed, Nov 12, 2008 at 12:44, Neil Aggarwal <neil@jammconsulting.com> wrote:
> Sorry for the red herring.

No problem.

> I am now convinced the problem is not in the firewall.
> It must be somewhere in Apache, Tomcat, or my
> application code (Most likely).  I think I
> was seeing the firewall logs after I restarted
> Apache since the responses were rejected since they
> no longer were attached to an established connection.

Look into the number of busy httpd servers, that might be your problem
(and why it's not accepting any new connections). To do that you can
use a configured URL in Apache (I believe it is /server-status) or you
can at least estimate using "ps" and comparing with the settings for
maximum number of servers in your httpd.conf.

HTH,
Filipe
_______________________________________________
CentOS mailing list
[email protected: C...@centos.org]
http://lists.centos.org/mailman/listinfo/centos

Thread : iptables starts blocking outbound http traffic
1)
Neil Aggarwal Hello: I have a machine running CentOS 5 x86_64. It is running apache httpd and tomcat. For some...
2)
Filipe Brandenburger Hi, If you're using ESTABLISHED, it depends on ip_conntrack being able to track the connections....
3)
Neil Aggarwal Filipe: Thanks for the information. If I do: cat /proc/sys/net/ipv4/netfilter/ip_conntrack_max on...
4)
Filipe Brandenburger Hi, Because this might potentially close several connections and free slots in the conntrack table....
5)
Neil Aggarwal Filipe: I changed the firewall rules on the server that had stopped responding to not use...
6)
Neil Aggarwal Filipe: One of my servers stopped responding again. This time, it was one of those which was not...
7)
Filipe Brandenburger Hi, No problem. Look into the number of busy httpd servers, that might be your problem use a...
8)
Kai Schaetzl Neil Aggarwal wrote on Thu, 6 Nov 2008 08:33:59 -0600: Why do you try to filter outbound...
9)
Joseph L. Casale You imply the *only* reason for outbound filtering is stop a hacker. In some environments it serves...
spacer
View PostFlat  Thread  Threaded | < Prev - Next >