Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I configured a proxypass rule in order to redirect requests from the port 443 to a JBoss server running on port 8080.

All works fine except some 503 errors in the Apache log, around 10 per day:

In the error log:

[error] (111)Connection refused: proxy: HTTP: attempt to connect to 127.0.0.1:8080 (127.0.0.1) failed

In the access log, I've a corresponding 503 error. Nothing in my JBoss log.

For each error, coincide a packet flagged as invalid in the kernel log. I performed a tcpdump and for each invalid packet, it was a tcp SYN from the proxy to the JBoss server.

Why these packets are flagged as invalid ? Is that a serious problem ? Can I accept all invalid packets from 127.0.0.1 to dport 8080 ?

share|improve this question
1  
I would have to better understand the nature of these packets before I'd say with a blanket statement that you should just accept them. A SYN from JBoss in what context? –  slm Feb 18 at 9:25
    
@slm What do you mean by "context" ? Our customers connect to our web application through apache on port 443. These requests are forwarded to JBoss on port 8080 (127.0.0.1:xxx -> 127.0.0.1:8080). Some of these requests, perhaps 3%, result in a 503 error due to invalid TCP SYN sent to JBoss. I've added a rule in iptables in order to accept invalid packets from 127.0.0.1 to port 8080. Nevertheless, the problem remains, we have a 503 error after few seconds :/ –  Bob Sauvage Feb 18 at 10:21
    
I performed a tcpdump and I'm now analyzing this dump with wireshark in order to understand why this packet is flagged as invalid. How can I find this information with wireshark ? Why the server doesn't send a SYN ACK ? –  Bob Sauvage Feb 18 at 10:22
    
My point was that JBoss doesn't just randomly start sending out SYN packets, there is some underlying context (JBoss is replying to a client due to some previous connection). Without knowing that you aren't going to get very far with help here. I mean no disrespect in that previous statement BTW. I would try and figure out what JBoss is attempting to do via it's logs here if possible. A SYN pckt typically has no payload, so there isn't going to be more to gleam from wireshark outside of JBoss is trying to talk to me. –  slm Feb 18 at 10:43
1  
@slm Thanks for your help. The problem is now solved and was related to iptables. I don't know why, some packets are flagged as INVALID when you use this kind of rules: iptables -A INPUT -m state --state INVALID -j REJECT and iptables -A INPUT -p tcp ! --syn -m state --state NEW -j REJECT --reject-with tcp-reset. A message has been sent to the iptables mailinglist. –  Bob Sauvage Feb 19 at 9:42

1 Answer 1

The problem is now solved and was related to iptables.

I don't know why, some packets are flagged as INVALID (1/1000) when you use this kind of rules:

iptables -A INPUT -m state --state INVALID -j REJECT

iptables -A INPUT -p tcp ! --syn -m state --state NEW -j REJECT --reject-with tcp-reset

As solution, I accept all packet (even invalid) from 127.0.0.1 from/to port 8080.

A message has been sent to the iptables mailinglist.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.