New answers tagged conntrack
This seems to be related to the Linux conntrack code being unhappy about the "long" delayed segment, aborting the connection because of unexpected data. The behavior can be mitigated by setting netfilter/nf_conntrack_tcp_be_liberal to 1. Kernel documentation: https://www.kernel.org/doc/Documentation/networking/nf_conntrack-sysctl.txt
RST and ACK,FIN packets are part of the very tail end of a TCP connection. My understanding is that iptables's connection tracking engine takes a pretty robust approach to deleting state table entries, for security reasons: as soon as it sees one end of a connection trying to close it down, then (knowing that such a request signals the end of a conection, ...
Top 50 recent answers are included