mikemol/fireholv6 — Issue #4: 'http', 'https' (and other TCP?) helpers shouldn't drop related traffic.
Author: mikemol
Created: 2012-01-03 05:26:34+00:00
State: open

On the tail end of TCP connections, unless both ESTABLISHED and RELATED packets are allowed via the conntrack module, we seem to be chopping off the final FIN packet.

This not only clutters up logs, it can change the way applications behave. For example, I've seen this interfere with early versions of Pandora's HTML5 interface; the song reached its end, but Pandora's server kept sending more data.

http and https helpers, and possibly most TCP helpers, should be configured to not drop that tail-end FIN packet.