+++ This bug was initially created as a clone of Bug #1169829 +++ (I checked system-config-firewall-1.2.29-12.fc21.src.rpm and the observations about RHEL5 predecessor below are still relevant to it. The code has been ported to Python and is in fw_iptables.py) See bug 1101522 "iptables rule ESTABLISHED occasionally not matching" Short story: REJECT rule can break networking by generating spurious connection aborts when an unexpected packet is seen. To prevent that, use DROP rule to filter our bad packets before REJECT, or use REJECT only for NEW packets, and DROP the rest. I believe relevant part of the source code is in system-config-securitylevel-1.7.0/lokkit.c here: for (i=0; ports && ports[i].start_port; i++) { ...creates "state NEW -j ACCEPT" rules... } fprintf(fw, "-A %s -j REJECT --reject-with icmp-host-prohibited\n", CHAIN_NAME); fprintf(fw, "-A FORWARD -j REJECT --reject-with icmp-host-prohibited\n"); It's trivial to add "-m state --state INVALID -j DROP" before each of these two REJECT rules. There is an analogous bit of code for IPv6 later in the same file.
Moving to firewalld. I don't think we care about system-config-firewall since firewalld is a default.
Created attachment 963804 [details] patch DROPing INVALID packets seems to be a common practice actually. What do you think about this patch Thomas ?
Changed upstream: https://git.fedorahosted.org/cgit/firewalld.git/commit/?id=354dcabd590da203ff9fb16c00296618c5da042a
firewalld-0.3.13-1.fc21 has been submitted as an update for Fedora 21. https://admin.fedoraproject.org/updates/firewalld-0.3.13-1.fc21
firewalld-0.3.13-1.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/firewalld-0.3.13-1.fc20
Package firewalld-0.3.13-1.fc21: * should fix your issue, * was pushed to the Fedora 21 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing firewalld-0.3.13-1.fc21' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-16322/firewalld-0.3.13-1.fc21 then log in and leave karma (feedback).
firewalld-0.3.13-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
firewalld-0.3.13-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.