Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    States in FIN_WAIT_2:FIN_WAIT_2 when they should not be

    Firewalling
    1
    1
    2297
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      adam65535 last edited by

      I am passing traffic from an IPSec VPN connection to a local lan network.  A tcpdump trace on the pfsense LAN side where the server is shows that the client and server are sending the correct FIN/ACK, ACK, FIN/ACK, ACK packets and the states on the server (tested with netstat) are going away properly.  The thing I am trying to figure out is why pfsense 2.0.3 firewall is keeping the states in a FIN_WAIT2:FIN_WAIT2 state instead of a TIME_WAIT state.  FIN_WAIT_2 should mean that a device received an ACK for its sent FIN and is now waiting for a matching FIN from the other side.  A trace on the firewall does show that the FIN/ACK and ACKs to the FIN are being sent though so the firewall should close the state or put them in TIME_WAIT state but that is not happening.

      These connections are TCP tests coming from a loadbalancer based on haproxy btw.  Connections directly from devices in the field seem to go into the correct TIME_WAIT state on the firewall.  Looking at wireshark traces I can't see where the difference is.  The only difference is with the firewall as the FIN_WAIT_2 connections are coming from an IPSec VPN whereas the ones that go into the proper TIME_WAIT state are being load balanced using the built in firewall load balancer (RDR I assume).  Maybe this is an issue with IPSec tunnels with pfsense?

      Keep in mind that the result of this doesn't break anything.  The states are just shown in the incorrect FIN_WAIT_2 state on the firewall instead of TIME_WAIT.  This is going to bug me until I find out the cause though.  I must know! :)

      STATES:
      all tcp 10.x.x.x:9000 <- 10.y.y.y:36148       FIN_WAIT_2:FIN_WAIT_2
         [3704256684 + 5888] wscale 0  [1870992773 + 65535] wscale 7
         age 00:00:16, expires in 00:01:14, 4:3 pkts, 216:168 bytes, rule 122
      all tcp 10.y.y.y:36148 -> 10.x.x.x:9000       FIN_WAIT_2:FIN_WAIT_2
         [1870992773 + 65535] wscale 7  [3704256684 + 5888] wscale 0
         age 00:00:16, expires in 00:01:14, 4:3 pkts, 216:168 bytes, rule 40
      
      TCPDUMP Trace:
      16:08:45.814000 IP 10.y.y.y.36148 > 10.x.x.x.9000: Flags [s], seq 1870992771, win 5840, options [mss 1460,sackOK,TS val 1625713552 ecr 0,nop,wscale 7], length 0
      16:08:45.814229 IP 10.x.x.x.9000 > 10.y.y.y.36148: Flags [S.], seq 3704256682, ack 1870992772, win 16384, options [mss 1460,nop,wscale 0,nop,nop,TS val 0 ecr 0,nop,nop,sackOK], length 0
      16:08:45.847842 IP 10.y.y.y.36148 > 10.x.x.x.9000: Flags [.], ack 1, win 46, options [nop,nop,TS val 1625713586 ecr 0], length 0
      16:08:45.847887 IP 10.y.y.y.36148 > 10.x.x.x.9000: Flags [F.], seq 1, ack 1, win 46, options [nop,nop,TS val 1625713586 ecr 0], length 0
      16:08:45.848556 IP 10.x.x.x.9000 > 10.y.y.y.36148: Flags [.], ack 2, win 65535, options [nop,nop,TS val 18189337 ecr 1625713552], length 0
      16:08:45.851434 IP 10.x.x.x.9000 > 10.y.y.y.36148: Flags [F.], seq 1, ack 2, win 65535, options [nop,nop,TS val 18189338 ecr 1625713552], length 0
      16:08:45.885035 IP 10.y.y.y.36148 > 10.x.x.x.9000: Flags [.], ack 2, win 46, options [nop,nop,TS val 1625713623 ecr 18189338], length 0
      
      RULES:
      @40 pass out all flags S/SA keep state allow-opts label "let out anything from firewall host itself"
        [ Evaluations: 1158184   Packets: 5595025   Bytes: 639394593   States: 890   ]
        [ Inserted: uid 0 pid 48874 ]
      @122 pass in quick on enc0 inet proto tcp from 10.y.y.y/24 to <ahservers:6> port = 9000 flags S/SA keep state label "USER_RULE: Allow ports from external load balancer"
        [ Evaluations: 255352    Packets: 1556036   Bytes: 135727661   States: 210   ]
        [ Inserted: uid 0 pid 48874 ][/s]</ahservers:6>
      
      1 Reply Last reply Reply Quote 0
      • First post
        Last post