Subject: http-gw and ftp-gw 'timing out'

From: Andrew Winter <[email-masked]>
Date: Fri, 2 Mar 2001 08:24:51 +1100

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Here's a difficult problem that people may be able to help me with.

We recently installed a 2mb HDSL (full duplex) connection.
Hence I started building a new firewall.

PII200 with 2 * 3c905c ethernet cards.
Redhat 6.2 (kernel 2.2.14-5.0)
compiled and installed fwtk2.1

Now if I use the ftp-gw or http-gw, for either ftp get or http get, the
majority of downloads (ie large files) 'stop'. they get to a certain point
and just sit there until it times out.
There is nothing in the log to indicate an error. The log shows the
download/get as starting but thats all. It occasionally works which is more
frustrating.

If I FTP directly from the FW machine to a site, i dont get any
hangs/freezes/stopping. It downloads properly and well. Therefore it's not
the HDSL link.

I've verified on many sites, including 'known good' and 'known fast'
(i've even started downloads thru both the ftp-gw and the machine itself at
the same time. the ftp-gw bombs out and the machine itself is fine)

Our internal network is fine, so all i can see that is problematic is the
plugs.

The load of the machine is fairly low when the 'freezes' happen.
The network load is fairly low (since we havent rolled out to the company
yet)
There are no tx or rx errors or overflows.
I've downloaded and installed all relevant patches
(jumbo/win95ftp/gate-ftp/non std ports ftp/extended ftp permissions), but no
resolution.
I've updated the kernel to kernel 2.2.17 - 14 but that doesnt help.
Using gcc egcs-2.91.66 to compile. no errors.
Tried updating ethernet drivers to the
http://www.scyld.com/network/vortex.html version.

-------------
On a different note -
FWTK requires ip_forwarding to be turned off
IPSEC requires ip_forwarding
Any probs if have ip_forwarding on and use ipfwadm/ipchains to only forward
to the IPSEC IP ranges, everything else is denied except for ports/hosts
defined by fwtk gws?

andrew

---

From: Ted Keller <[email-masked]>
Date: Thu, 1 Mar 2001 19:36:11 -0500 (EST)

Andrew,

This sounds like a timeout issue somewhere - and probably the command port
is timeing out during the file transfer.  Not sure what is in front of the
firewall (router - other firewall) but make sure that idle connections
(ftpcommand port) don't have timeout values associated with them - or at
least extend them out a bit.

ted keller

---

From: Rick Murphy <[email-masked]>
Date: Thu, 01 Mar 2001 21:29:31 -0500

>least extend them out a bit.

I've also seen problems like this when there's a MTU mismatch somewhere and 
a filter is keeping MTU discovery from working. Try setting the MTU on your 
external interface to something small (576 bytes) and see if the problem 
gets better.
          -Rick