Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a firewall that has 3 IP aliases on 1 physical interface. Packets get dropped between these 3 interfaces (either ICMP, HTTP, or anything else). We tracked it down to these packets being marked INVALID in the FORWARD rule and dropped due to the this rule:

chain FORWARD {
    policy DROP;

    # connection tracking
    mod state state INVALID LOG log-prefix 'INVALID FORWARD DROP: '; 
    mod state state INVALID DROP;
    mod state state (ESTABLISHED RELATED) ACCEPT;

(That is, we see the INVALID FORWARD DROP logs in dmesg)

What could be causing this?

share|improve this question

The INVALID state means that the packet is not associated with a known connection (and isn't starting a new connection either). The only reasons I can think of is that something is clearing the connection tracking table, the table is overflowing, or the entries are timing out too quickly. You can check the size of the connection tracking table with sudo conntrack -L | wc -l and the maximum number of entries with cat /proc/sys/net/ipv4/netfilter/ip_conntrack_max.

share|improve this answer
The conntrack is not full. Which parameter could cause a timeout? – ℝaphink Oct 25 '12 at 7:22
@ℝaphink There are numerous timeout parameters for different situations, have a look in /proc/sys/net/ipv4/netfilter/. ip_conntrack_generic_timeout is probably the most important one. – mgorven Oct 25 '12 at 16:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.