I have iptables setup on a Fedora box of mine. I'm allowing all inbound HTTPS traffic, all outbound traffic, and I also have an allowed estbalished,related rule. However I am seeing drop entries in my logs like this:
Traffic Dropped: SRC=X.X.X.X DST=My_Server_IP DF PROTO=TCP SPT=443 DPT=Random_High_Port
Why isn't my established/related related rule picking this up and allowing it? My only thought is that it's timing out the connection before this reply is received. If that is the case, does anyone know what this timeout window is or if it can be modified? Thanks.
EDIT:
Here is a full packet
Dropped Traffic: IN=eth0 OUT= MAC=_____________ SRC=X.X.X.X DST=Y.Y.Y.Y LEN=81 TOS=0x00 PREC=0x00 TTL=46 ID=11862 DF PROTO=TCP SPT=443 DPT=50680 WINDOW=6235 RES=0x00 ACK PSH FIN URGP=0
Here are the 3 IP table rules that matter to this scenario
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m state --state NEW --dport 443 -j ACCEPT
/sbin/iptables -P OUTPUT ACCEPT
This should be incoming traffic related to an outbound connection since the source is 443. I just need to know why it is failing and/or what the time out is.