[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: port blocking? oracle problem? Other?



Without your rules, I can only guess, but if I had to guess I'd say the 
firewall is having its state table filled up with the increase in traffic 
(coming from quearys to the oracle box which are now having to go through the 
firewall). When that happens, it flushes the table and packets relying on 
state would get blocked on their way back in or out.

Matt


On Friday 15 February 2002 02:44 pm, john abbott wrote:
> OK, here is the deal, I had one firewall, HP Vectra XU 150 Pent. Pro
> running openbsd 2.8 and ipf.   Behind it I had four web servers and an
> oracle server.  Everything was running great.
>
> But, because of some other software that was running on the oracle
> server, it seemed like a really great idea to move the oracle server and
> setup firewall #2, also a HP Vectra XU with only the oracle server
> behind it.  Troubles.
>
> The web servers behind firewall #1 and are making queries (and replies?)
> via port 1521 to the oracle server and everything is working great.
> ...for a few hours.  Then something happens, and I don't know quite
> what, but suddenly port 53 and 1521 starts being blocked.
>
> Nov 29 12:50:39 webwall ipmon[7936]: 12:50:38.533470             fxp0
> @0:58 b 156.92.18.90,53 -> 156.92.18.150,10007 PR udp len 20 150  IN
> Nov 29 12:50:54 webwall ipmon[7936]: 12:50:53.648449             fxp0
> @0:58 b 156.92.215.252,1521 -> 156.92.18.150,10008 PR tcp len 20 44 -AS
> IN
>
> (yeah, ok, I need to set the date on my firewall :-) The web servers can
> no longer find the oracle servers and 1521 is getting blocked too.
> Other stuff continues to work just fine, port 80 keeps getting passed
> just fine, I can still ssh into the machines just fine.
>
> I guess my questions are, what could be causing this?  Why would it only
> be causing trouble with just these ports?   Are the firewalls getting
> overloaded or something and is that what causes these ports to become
> blocked?
>
> --ja


Visit your host, monkey.org