Re: PGSQL x iptables - Mailing list pgsql-general

From Craig Ringer
Subject Re: PGSQL x iptables
Date
Msg-id 4A01407A.4080107@postnewspapers.com.au
Whole thread Raw
In response to PGSQL x iptables  ("Slansky Lukas" <Lukas.Slansky@upce.cz>)
Responses Re: PGSQL x iptables
Re: PGSQL x iptables
List pgsql-general
Slansky Lukas wrote:

> 1. -A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
>
> 2. -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s
> aaa.bbb.ccc.ddd --dport 5432 -j ACCEPT
>
> 3. -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
>
>
>
> I was wondering when these rules are not OK for our environment. It
> seems that rules 1 and 2 sometimes pass packets and therefore these
> packets are rejected.

After a long period of inactivity, perhaps?

If you're relying on `-m state' or `-m ctstate' you should be using a
TCP keepalive. Otherwise the connection tracking entry for the
connection will be purged after a while - how long depends on your
firewall configuration - and then packets will no longer be seen as part
of an established connection.

--
Craig Ringer

pgsql-general by date:

Previous
From: John R Pierce
Date:
Subject: Re: PGSQL x iptables
Next
From: durumdara
Date:
Subject: Transaction settings: nowait