2

I configured a proxypass rule in order to redirect requests from the port 443 to a JBoss server running on port 8080.

All works fine except some 503 errors in the Apache log, around 10 per day:

In the error log:

[error] (111)Connection refused: proxy: HTTP: attempt to connect to 127.0.0.1:8080 (127.0.0.1) failed

In the access log, I've a corresponding 503 error. Nothing in my JBoss log.

For each error, coincide a packet flagged as invalid in the kernel log. I performed a tcpdump and for each invalid packet, it was a tcp SYN from the proxy to the JBoss server.

Why these packets are flagged as invalid ? Is that a serious problem ? Can I accept all invalid packets from 127.0.0.1 to dport 8080 ?

8
  • 1
    I would have to better understand the nature of these packets before I'd say with a blanket statement that you should just accept them. A SYN from JBoss in what context?
    – slm
    Commented Feb 18, 2014 at 9:25
  • @slm What do you mean by "context" ? Our customers connect to our web application through apache on port 443. These requests are forwarded to JBoss on port 8080 (127.0.0.1:xxx -> 127.0.0.1:8080). Some of these requests, perhaps 3%, result in a 503 error due to invalid TCP SYN sent to JBoss. I've added a rule in iptables in order to accept invalid packets from 127.0.0.1 to port 8080. Nevertheless, the problem remains, we have a 503 error after few seconds :/ Commented Feb 18, 2014 at 10:21
  • I performed a tcpdump and I'm now analyzing this dump with wireshark in order to understand why this packet is flagged as invalid. How can I find this information with wireshark ? Why the server doesn't send a SYN ACK ? Commented Feb 18, 2014 at 10:22
  • My point was that JBoss doesn't just randomly start sending out SYN packets, there is some underlying context (JBoss is replying to a client due to some previous connection). Without knowing that you aren't going to get very far with help here. I mean no disrespect in that previous statement BTW. I would try and figure out what JBoss is attempting to do via it's logs here if possible. A SYN pckt typically has no payload, so there isn't going to be more to gleam from wireshark outside of JBoss is trying to talk to me.
    – slm
    Commented Feb 18, 2014 at 10:43
  • 1
    @slm Thanks for your help. The problem is now solved and was related to iptables. I don't know why, some packets are flagged as INVALID when you use this kind of rules: iptables -A INPUT -m state --state INVALID -j REJECT and iptables -A INPUT -p tcp ! --syn -m state --state NEW -j REJECT --reject-with tcp-reset. A message has been sent to the iptables mailinglist. Commented Feb 19, 2014 at 9:42

1 Answer 1

1

The problem is now solved and was related to iptables.

I don't know why, some packets are flagged as INVALID (1/1000) when you use this kind of rules:

iptables -A INPUT -m state --state INVALID -j REJECT

iptables -A INPUT -p tcp ! --syn -m state --state NEW -j REJECT --reject-with tcp-reset

As solution, I accept all packet (even invalid) from 127.0.0.1 from/to port 8080.

A message has been sent to the iptables mailinglist.

2
  • 1
    Side note: You may DROP invalid packets directly, non-syn REJECT, that's ok. Cheers Commented Feb 14, 2022 at 12:15
  • 2
    The updated iptables documentation tells you must never REJECT an INVALID packet, only DROP it. The explanation is in the manual (but didn't exist in 2014): manpages.debian.org/iptables/…
    – A.B
    Commented Jun 18, 2022 at 16:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .