0

I would like to know what will happen to an ESTABLISHED connection between two hosts (say A:9999 & B:8888), after a firewall restriction enabled between those two hosts thus preventing any communication between the hosts or on specific ports.

I think we can expect same result when the network service is down.

My observation is the process (in my case: it's ldapsearch query running on 'host A' with a huge output) stops after few minutes, but also the subsequent commands in the parent process fails to run. So, I am confused what is happening and why the subsequent commands can't continue which doesn't have any network dependency like an echo command.

GP92
  • 681
  • 2
  • 9
  • 27
  • I read that the connection will be closed at one host after tcp_keepalive_time if there is no response from other host. The default value is 7200 in my RHEL 7 host and I have tested with setting of 60 and it didn't close even after 5 minutes. Also, I wonder why such a larger value of 7200 for tcp_keepalive_time by default. – GP92 Jul 11 '18 at 16:31

1 Answers1

0

If the firewall is stateful, Then typically the connection will stay open for as long as the tcp session is alive.

Once the tcp fin_ack is sent by the remote end, then new SYN packets coming from the host that is "blocked" (packets are dropped or replied to with an RST flag or icmp reject) will not get through the firewall to request the new TCP session.

For UDP, since the protocol is sessionless, traffic will immediately be blocked.

frontsidebus
  • 536
  • 2
  • 7