strange iptables behavior

[Mike McGrath]

-- sorry bout the last post, this one's got better formatting.

I've got an odd iptables issue going on.  Here's the setup.  Host A is
using mod_jk to connect to host B running a tomcat instance on port
9009.  It will work fine for a while and then I start getting denies for
no reason.  When the denies start happening, the website I'm trying to
bring up freezes in the middle of the page.  If I click stop and reload
the page sometimes it will come up, sometimes it will not and I will
continue getting denies.  Also when its in the middle of loading a page
and it freezes, if I flush all the iptables rules out the page will
load.  I'm running Fedora Core 3 on both machines, Here are my iptables
rules:

------------------------------------------
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 9009
-j ACCEPT 
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j
ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 8009
-j ACCEPT 
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 9080
-j ACCEPT 
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 161 -j
ACCEPT 
-A RH-Firewall-1-INPUT -p icmp --icmp-type echo-request -j ACCEPT 
-A RH-Firewall-1-INPUT -p icmp --icmp-type echo-reply -j ACCEPT 
-A RH-Firewall-1-INPUT -j LOG --log-level info --log-prefix "IPTABLES --
DENY "
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
------------------------------------------


These are the Denies:


------------------------------------------
Mar 30 09:27:10 mel kernel: IPTABLES -- DENY IN=eth1 OUT=
MAC=00:09:6b:ff:45:08:00:07:e9:23:e0:88:08:00 SRC=10.10.0.28
DST=10.10.0.10 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=7193 DF PROTO=TCP
SPT=41149 DPT=9009 WINDOW=10872 RES=0x00 ACK URGP=0 
Mar 30 09:27:10 mel kernel: IPTABLES -- DENY IN=eth1 OUT=
MAC=00:09:6b:ff:45:08:00:07:e9:23:e0:88:08:00 SRC=10.10.0.28
DST=10.10.0.10 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=7195 DF PROTO=TCP
SPT=41149 DPT=9009 WINDOW=10872 RES=0x00 ACK URGP=0 
Mar 30 09:27:10 mel kernel: IPTABLES -- DENY IN=eth1 OUT=
MAC=00:09:6b:ff:45:08:00:07:e9:23:e0:88:08:00 SRC=10.10.0.28
DST=10.10.0.10 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=7197 DF PROTO=TCP
SPT=41149 DPT=9009 WINDOW=10872 RES=0x00 ACK URGP=0 
Mar 30 09:27:10 mel kernel: IPTABLES -- DENY IN=eth1 OUT=
MAC=00:09:6b:ff:45:08:00:07:e9:23:e0:88:08:00 SRC=10.10.0.28
DST=10.10.0.10 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=7199 DF PROTO=TCP
SPT=41149 DPT=9009 WINDOW=10872 RES=0x00 ACK URGP=0 
Mar 30 09:27:10 mel kernel: IPTABLES -- DENY IN=eth1 OUT=
MAC=00:09:6b:ff:45:08:00:07:e9:23:e0:88:08:00 SRC=10.10.0.28
DST=10.10.0.10 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=7201 DF PROTO=TCP
SPT=41149 DPT=9009 WINDOW=10872 RES=0x00 ACK
URGP=0------------------------------------------

I can't imagine what on earth would be causing this.  Anyone out there
ever seen this or have any ideas?

	-Mike