Welcome to the Sophos User Bulletin Board.
If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

Reply
 
LinkBack Thread Tools Display Modes
Junior Member
Join Date: Sep 2011
Posts: 26
#1 (permalink)  
Old 11-09-2011, 02:15 PM
Default idle tcp connection timeout

Hi
I am using astaro gateway 8.0 .Is there feature to manually configure the Idle tcp connection timeout in astaro.

Thanks
Reply With Quote
Junior Member
Join Date: Sep 2011
Posts: 26
#2 (permalink)  
Old 01-06-2012, 10:40 AM
Default

Hi
I have configured ip_conntrack_tcp_timeout_established" =900 sec
still if connection remains idle for more than 900 sec then also not dropped by firewall
My configuration are
masquerading rule between client and server
client in internal network and server is in public network
in packet filter Allow all packet using any service from internal to internet
Thanks
Reply With Quote
Junior Member
Join Date: Sep 2011
Posts: 26
#3 (permalink)  
Old 07-11-2012, 11:08 AM
Default

Hi All
Can I know how astaro internally drops idle tcp connection.Does it sends any packet when drops TCP connection

Thanks
Reply With Quote
Moderator
Join Date: Jul 2001
Location: southern California
Posts: 12,064
#4 (permalink)  
Old 07-11-2012, 08:15 PM
Default

Some firewalls can be configured to send a RST when timing out the connection, but most likely that is not the default configuration for Astaro; e.g. any new traffic on the connection will be blocked until the clients restart the connection.

Are you sure the connection is idle (did you run a sniffer?)?
Some applications such as SSH can send a NOOP to keep the connection alive.

It's possible that you may also need to turn on "Use strict TCP session handling" in WebAdmin under Network Security > Firewall > Advanced.

Barry
__________________
http://BlogSec.net
http://JobOyster.com
http://DealBert.net
IT Consultant specializing in high-performance Web Infrastructure and Security.
Astaro End-user since v1.x
  • ASL 9.2x, HP DL360G5 - FW, IPS, VPNs
  • ASL 9.2x, 2 Dell 1950's as WAF/proxy w HA
  • UTM 9.1x, Atom n270, 2GB RAM, 2 Intel GigE
    Netgear GS108T gigE switch & Astaro AP30 Access Point with 4 VLANs.
    60/60mbit FiOS internet.
  • Pending - UTM 9.2x, i5-4670, 4GB RAM, 2 Intel GigE
    Needs new NIC drivers before deploying
Reply With Quote
Junior Member
Join Date: Sep 2011
Posts: 26
#5 (permalink)  
Old 07-25-2012, 05:37 AM
Default

Thanks BarryG.Actually I am using astaro to test my client server based application.I wanted to know one more thing that when my clint is in internal network and server is in public network,and masquerading rule Internal(network) ------>external(address) is configured.If am sending data from server to client then it is taking some more time than data sending from server to client when there is no firewall.But it is fine in case of data transfer from client to server having above configuration.Is astaro makes some dealay is above scenario?
Reply With Quote
Moderator
Join Date: Jul 2001
Location: southern California
Posts: 12,064
#6 (permalink)  
Old 07-25-2012, 07:56 AM
Default

1. Are you using the http proxy? (aka content filter aka web security) --there can be some delays added, especially if doing anti-virus scanning.
take a look at the web log to see if some of the packets are getting blocked.

2. the IPS and some other features can cause slowdowns. Check your hardware graphs, including CPU and RAM utilization.
Run 'top' during a data transfer and see if there is high CPU utilization.
disable the IPS and application detection, and see if there's any difference

3. how fast is your internet connection?

4. what is your CPU and RAM configuration?

5. take a look at the IPS log to see if some of the packets are getting blocked.

6. what kind of connection are you using (PPPoE or Ethernet)?
Are you using a VPN?
maybe your MTU is wrong.

Barry
__________________
http://BlogSec.net
http://JobOyster.com
http://DealBert.net
IT Consultant specializing in high-performance Web Infrastructure and Security.
Astaro End-user since v1.x
  • ASL 9.2x, HP DL360G5 - FW, IPS, VPNs
  • ASL 9.2x, 2 Dell 1950's as WAF/proxy w HA
  • UTM 9.1x, Atom n270, 2GB RAM, 2 Intel GigE
    Netgear GS108T gigE switch & Astaro AP30 Access Point with 4 VLANs.
    60/60mbit FiOS internet.
  • Pending - UTM 9.2x, i5-4670, 4GB RAM, 2 Intel GigE
    Needs new NIC drivers before deploying
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT. The time now is 12:46 PM.


Powered by vBulletin® Version 3.8.6
Copyright ©2000 - 2015, Jelsoft Enterprises Ltd.

These pages are specifically maintained for the discussion of firewall issues within the Open Source community, and might already reflect new alpha/beta releases under development. Please refer to our product specifications for the functionality of the actual release. Discussions of new/enhanced functionality does not constitute a commitment of Astaro, to integrate this functionality into future releases.