When a client connects to a FTP server through gentoo gateway and then closes the connections Gentoo reports the connection is still open. The connections has been open for 24 hours so far and I have rebooted the client and Gentoo still shows that the conection from the client to the FTP server to still be ESTABLISHED. I only notice it for nat'ed FTP connections. Using 'netstat-nat' and 'cat ip_conntrack | grep port=21'. Both show the connection open. Reproducible: Always Steps to Reproduce: 1. set up gentoo to Masquerade 2. have a client connect to an ftp server though the gentoo gateway 3. have the client close the connection Actual Results: Gentoo shows to keep the FTP connection open even though it has been closed and the client rebooted to make sure it is closed. Expected Results: should show the connection in a TIME_WAIT state then CLOSED Portage 2.0.51.19 (default-linux/x86/2004.3, gcc-3.3.5, glibc-2.3.4.20041102-r1, 2.6.11-gentoo-r5 i686) ================================================================= System uname: 2.6.11-gentoo-r5 i686 AMD Athlon(tm) XP 2400+ Gentoo Base System version 1.4.16 Python: dev-lang/python-2.3.4-r1 [2.3.4 (#1, Feb 7 2005, 15:29:12)] distcc 2.16 i686-pc-linux-gnu (protocols 1 and 2) (default port 3632) [enabled] ccache version 2.3 [enabled] dev-lang/python: 2.3.4-r1 sys-devel/autoconf: 2.13, 2.59-r6 sys-devel/automake: 1.5, 1.7.9-r1, 1.6.3, 1.4_p6, 1.9.4, 1.8.5-r3 sys-devel/binutils: 2.15.92.0.2-r7 sys-devel/libtool: 1.5.10-r4 virtual/os-headers: 2.6.8.1-r2 ACCEPT_KEYWORDS="x86" AUTOCLEAN="yes" CFLAGS="-march=athlon-xp -O2 -pipe -fomit-frame-pointer" CHOST="i686-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3/share/config /usr/lib/X11/xkb /usr/share/config /var/bind /var/qmail/control" CONFIG_PROTECT_MASK="/etc/gconf /etc/terminfo /etc/env.d" CXXFLAGS="-march=athlon-xp -O2 -pipe -fomit-frame-pointer" DISTDIR="/usr/portage/distfiles" FEATURES="autoaddcvs autoconfig ccache distcc distlocks sandbox sfperms" GENTOO_MIRRORS="http://gentoo.chem.wisc.edu/gentoo/ http://gentoo.oregonstate.edu http://www.ibiblio.org/pub/Linux/distributions/gentoo" MAKEOPTS="-j5" PKGDIR="/usr/portage/packages" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" SYNC="rsync://scout.circletgsc.org/gentoo-portage" USE="x86 aalib adns alsa apache2 avi bcmath berkdb bitmap-fonts chroot crypt cups curl emboss encode ethereal fastcgi fbcon font-server foomaticdb fortran freetds gd gdbm gif gpm imlib ipv6 java jpeg ldap libg++ libwww mad mbox mikmod milter mime mmx motif mp3 mpeg mysql mysqli ncurses nls nocardbus nptl nptlonly odbc oggvorbis opengl pam pcre pdflib perl php png python quicktime readline samba sasl sdl simplexml slang sockets spell spl sqlite sse ssl svga tcltk tcpd tiff truetype truetype-fonts type1-fonts xml xml2 xmlrpc xmms xv zlib" Unset: ASFLAGS, CBUILD, CTARGET, LANG, LC_ALL, LDFLAGS, PORTDIR_OVERLAY
I just recompiled the kernel with netfilter as modules instead of built in and it seems to have fixed the problem.
Looks like a bug the netfilter guys upstream (https://bugzilla.netfilter.org) might want to have a look into as we don't touch the netfilter code in gentoo-sources-2.6...
