Firewall - Strange behavior

[dacicusmaximus (Marco Polo)]

Hello from few days I have reported disconnections to a local server located in DMZ from green side of IPFire.
To understand below is the diagram:

In the logs I noticed the following entries (a few thousand):
DROP_CTINVALID red0 TCP 10.8.8.205 x.x.x.208 443(HTTPS) 54518
…
DROP_NEWNOTSYN red0 TCP 10.8.8.205 x.x.x.208 7778 49824

The disconnection takes about 5 minutes during which the respective logs appear, after which everything works correctly. From outside of LAN (Green) everything running normally (Ex: If I connect from my phone to respective server it’s working).
The Border Router make src nat and dst nat for that server (10.8.8.205 to x.x.x.205).
The problem has been manifesting for several days and I don’t know where to start. I downgraded both routers, but it still appears. It usually appears 4, 5 times a day, for 5 minutes each.
I ask you for an advice, what do you think is wrong. Who is guilty: Border Router or IPFire?
Thank you.

[jon]

You can read about DROP_CTINVALID and DROP_NEWNOTSYN here:

Firewall Options - The IPFire Wiki

and see this post:

DROP_CT_INVALID message since upgrading

Hi! Since upgrading to core 167 today, I’m seeing many DROP_CTINVALID messages on firewall log: [grafik] Raw format: 11:47:15 IN=red0 OUT= MAC=00:0d:b9:47:66:e9:74:42:7f:4a:e0:27:08:00 SRC=81.3.27.54 DST=172.17.0.2 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=TCP SPT=853 DPT=47344 WINDOW=0 RES=0x00 RST URGP=0 MARK=0x4000ca66 11:47:12 IN=red0 OUT= MAC=00:0d:b9:47:66:e9:74:42:7f:4a:e0:27:08:00 SRC=81.3.27.54 DST=172.17.0.2 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=TCP SPT=853 DPT=4734…

There are posts about DROP_NEWNOTSYN also.

I get LOTS of those messages also. I disabled both of these messages in with the top two Firewall logging settings:

As for the disconnection issue, please look for other log entries at the time of the disconnection.

Are there logs in the Border Router you can review also?

[dacicusmaximus (Marco Polo)]

Thank you for your reply.
I did a search before to create this topic, and I found results you re-posted, but didn’t help me a lot, maybe only to not see more logs, but the disconnects problems still exist.
I exclude the border router because the outside can access the server without interruptions.
Next step I will try to replace the IPFire machine with another one, with an older version, maybe Core-Update 170.
I can’t explain packets coming from an Private IP (10.8.8.205) to the WAN (Red) of the IPFire (x.x.x.208 - public IP). I believed on the public side exists only public IP’s.