Uploads fail with shorewall enabled

Question

I have an Ubuntu 8.04 server with shorewall 4.0.6 installed. When I try to upload files using FTP, SCP, or cURL the file upload stalls almost immediatly and eventually times out. If I turn off shorewall then the uploads work fine. I don't have any rules that specifically allow FTP and I'm not too concerned with it, but I do need to be able to upload via 22 (SCP) and 80 & 443 (cURL).

This is what my rules look like:

COMMENT Allow Server to respond to any web (80) and SSL (443) requests
ACCEPT  net     $FW      tcp     80 
ACCEPT  $FW     net     tcp     80
ACCEPT  net     $FW      tcp     443
ACCEPT  $FW      net     tcp     443

COMMENT Allow Server to respond to SNMPD (161) requests
ACCEPT  net     $FW      udp     161

COMMENT Allow Server to respond to MySQL (3306) requests (for MySQL Graphing)
ACCEPT  net     $FW      tcp     3306

COMMENT Allow Server to respond to any SSH connection attempts, and to SSH out.
SSH/ACCEPT      net     $FW
SSH/ACCEPT      $FW     net

COMMENT Allow Server to make DNS Requests out.
DNS/ACCEPT      $FW             net

COMMENT Default "close" anything else.
Ping/REJECT     net             $FW
ACCEPT          $FW             net             icmp
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

I expected the top four ACCEPT lines to allow inbound and outbound traffic over 80 and 443 and I expected the two SSH/ACCEPT lines to allow inbound and outbound trffic over 22, including SCP.

Any help is greatly appreciated.

/etc/shorewall/policy contains the following (all lines above are commented out):

#
# Allow all connection requests from teh firewall to the internet
#
$FW             net             ACCEPT

#
# Policies for traffic originating from the Internet zone (net)
# Drop (ignore) all connection requests from the Internet to the firewall
#
net             all             DROP            info

# THE FOLLOWING POLICY MUST BE LAST
# Reject all other connection requests
all             all             REJECT          info

#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE

Answer 1

Please make sure that there is no traffic shaper running (maybe shorwall starts one). You could check this by running tc qdisc show dev eth0. If there is no shaper active, it may help to have a output of

iptables -Lnv
iptables -Lnv -t mangle

Answer 2

FTP is not going to work with these rules until you allow it explicitly (unless you have a permitting policy instead, which would make these rules pointless).

You rules seem to allow SSH, HTTP and HTTPS though, but you can check your log files or capture traffic to verify this.

By the symptom you mention (starts and then stalls) I think your TCP MSS might be misconfigured. See your shorewall.conf and check the CLAMPMSS parameter. You might want to try clamping it low and see if the problem goes away.

Edit: I see in your policy file that you allow all outgoing traffic, so Shorewall shouldn't be the cause of your problem. Does the problem persist if you clear Shorewall? (shorewall clear).