Invalid Traffic / Invalid TCP state (no routing issue)

RE: Invalid Traffic / Invalid TCP state (no routing issue)

Gerhard Sauer — Sat, 23 Nov 2024 10:20:40 GMT

MTU size is 1492 on both internet connections

RE: Invalid Traffic / Invalid TCP state (no routing issue)

LuCar Toni — Sat, 23 Nov 2024 08:29:50 GMT

So, could it be an issue with the MTU size of your WAN GW?

Based on your tcpdump, it looks like an issue with the packets coming back from the server. As the servers packets are not valid for the firewall.

My firewall(s) are not causing the same issues on any gateway.

You could dump it into a file and analyze it via wireshark: https://wiki.wireshark.org/TCP_Analyze_Sequence_Numbers

BTW: I found an interesting post on this subject: https://blog.ipspace.net/2016/02/should-firewalls-track-tcp-sequence/

RE: Invalid Traffic / Invalid TCP state (no routing issue)

Gerhard Sauer — Sat, 23 Nov 2024 01:55:44 GMT

both wan gateways are active and not on standby.

The same happens, when I disable the first internet connection.

each internet connection uses an own physical ethernet cable and own IP range. SD WAN routing and NAT routing applies to the machines.

RE: Invalid Traffic / Invalid TCP state (no routing issue)

Gerhard Sauer — Sat, 23 Nov 2024 01:46:09 GMT

I cannot open the telekom website at all when tcp seq checking is on (on the second line)

RE: Invalid Traffic / Invalid TCP state (no routing issue)

LuCar Toni — Fri, 22 Nov 2024 14:00:41 GMT

Just to be sure: Do you have any kind of Issue or is it only about the "invalid traffic" Logging?

RE: Invalid Traffic / Invalid TCP state (no routing issue)

LHerzog — Fri, 22 Nov 2024 13:13:37 GMT

How is your WAN Gateway setup? both lines active or one standby? Does the same happen when only one line is disconnected or disabled?

First thought is about a asynchronous routing issue but you'd need to dump the traffic on CLI for each in and out interface and see where the packets are actually going.

Incoming packets seem to match no active tcp connection - thus being dropped.

Also cli tool drppkt may be helpful du analyze.

I suspect that the traffic is at least in parts going over different interfaces.