I have set up a VPN between my company and a customer. Packet captures show that the customer receives a packet and then sends an ACK back as it hits our internet firewall, this is as far as the connection will go. The process then repeats itself a few times with the same results.
The packet capture shows all of this on the egress filter, is this normal? I see nothing on the ingress filter.
10.10.10.10.56638 > 56.132.112.29.3205: S 74549533:74549533(0) win 5840 <mss 1380,sackOK,timestamp 2566921403 0,nop,wscale7>
56.132.112.29.3205 > 10.10.10.10.56638: S712870551(0) ack 74549534 win 16384 <mss 1380,nop,wscale 0, nop,nop,timestamp 0 0,nop,nop,sackOK>
56.132.112.29.3205 > 10.10.10.10.56638: S712870551(0) ack 74549534 win 16384 <mss 1380,nop,wscale 0, nop,nop,timestamp 0 0,nop,nop,sackOK>
10.10.10.10.56638 > 56.132.112.29.3205: S 74549533:74549533(0) win 5840 <mss 1380,sackOK,timestamp 2566921403 0,nop,wscale7>
Then I decided to capture on the next firewall and found results that I do not understand:
ingress:
10.10.10.10.55640 > 56.132.112.29.3205: S 155629610:155629610(0) win 5840 <mss 1380, sackOK, timestamp 2568128672 0, nop, wscale 7>
10.10.10.10.55640 > 56.132.112.29.3205: S 155629610:155629610(0) win 5840 <mss 1380, sackOK, timestamp 2568128672 0, nop, wscale 7>
egress:
10.10.10.10.55640 > 56.132.112.29.3205: S 3671255214:3671255214(0) win 5840 <mss 1460, sackOK, timestamp 2568128672 0, nop, wscale 7>
10.10.10.10.55640 > 56.132.112.29.3205: S 3671255214:3671255214(0) win 5840 <mss 1460, sackOK, timestamp 2568128672 0, nop, wscale 7>
So of course the egress is fine, these are the packets leaving our network to the internet firewall. What does the ingress filter mean? To me it says that a packet has arrived at my internetdmz and matches the packet that left with regards to the source and destination IP. This does not make sense to me. Can anyone explain why this is?
S 74549533
is the sequence number in the first line of code, which is acknowldged by the second/third line,ack 74549534
(sequence +1) which is then retrainsmitted by 10.10.10.10 in the fourth line withS 74549533
.