US Telco Support > AT&T > AT&T Southeast > 327w firewall "state" rule times out in 10sec?!?

327w firewall "state" rule times out in 10sec?!?

Here's what my router's help page says about state:

state
Specifies that the TCP/ICMP/IGMP session (particularly the sequence number in the case of TCP and the packet type and source/destination addresses and ports in the case of ICMP and IGMP) associated with this packet will be added to the state table maintained by the filtering engine. As long as that session remains in the state table all packets associated with that session are passed without comparing them to the rules decision tree. The filtering engine state table logic maintains the state of the session with successive packets and closes or times it out (removes it from the state table) whenever appropriate.

reply to impala
for reference, here are my inbound firewall rules:
credit BellSouth 327W and N O Y B in the Westell FAQ for ideas.

title [ Security Level Custom (Medium) IN rules ]
begin
RulesInDropDHCPAddress
drop from addr 0.0.0.0 >> done, alert 4 [0.0.0.0 Source IP Address]
RulesInPassIcmpRequest
pass icmp-type request, to addr %WANADDR%:32 >> done, alert 0 [pinged]
RulesInDropTTL
drop match 3 8 { 01:FE } >> done, alert 3 [TTL of 0 or 1]
# Pass and Log Specific ICMP
RulesInPassICMP
pass icmp-type reply >> done, alert 0 [Ping Reply] # Type: 0 
pass icmp-type exceeded >> done, alert 0 [traceroute reply] # Type: 11 
pass icmp-type unreachable >> done, alert 0 [Dst Unreachable] # Type: 3 
RulesInDropFrom192
drop from addr %LANADDR%:%LANMASK% >> done, alert 4 [WAN Traffic from LAN IP]
# Drop All Unsolicited Inbound
RulesInDropAll
drop all >> done, alert 1 [Drop All Unsolicited Inbound]
end
 

reply to impala
so I've already mentioned that http; https; and ssh fail after approximately 10 seconds of inactivity when I enable the state action in the outbound firewall.

However, NNTP (port 123) and DNS (port 53) fail unless I enable the state action in the firewall; or explicitly enable them for dynamic NAT. They fail because the inbound firewall drops them AFTER NAT does it magic and converts the destination IP. I don't understand the difference between how NAT handles SSH; HTTP; HTTPS; and NNTP; DNS. I suppose SSH; HTTP; and HTTPS are hard-coded for dynamic NAT even though they do not show up in the list of enabled NAT client services? And NNTP; and DNS are not hard-coded and must be manually enabled?

And I still fail to understand how enabling the state action on HTTP; HTTPS; and SSH cause them to fail, even if they are using dynamic NAT.

3   04/06/2008 13:27:38 Inbound       1  RulesInDropAll  Drop All Unsolicited Inbound 
IP Packet Header:
Src Addr : 130.127.8.8  Dest Addr: 192.168.19.239
UDP Packet Header:
   Src Port: 53  Dest Port: 49273
 
4   04/06/2008 13:27:28 Inbound       1  RulesInDropAll  Drop All Unsolicited Inbound 
IP Packet Header:
Src Addr : 17.254.0.27  Dest Addr: 192.168.19.239
UDP Packet Header:
   Src Port: 123  Dest Port: 123
 

Let's see if we can find you some help in our AT&T Southeast forum.

Good luck.