The fragments are handled as follows:
- Frame is received by the Firewall.
- The Firewall recognizes that the "More Fragments" flag is set.
- The Firewall records the fragment into the "
frag_table" kernel table (this table has a limit of "100" entries and a timeout of "1" second, by default).
Once the fragment is recorded in the "
frag_table" kernel table, this frame is dropped with a debug print.
First frame of fragmented connection will generate a print that contains the Proto / IP address / Ports:
fw_log_drop: Packet proto=17 220.127.116.11:161 -> 18.104.22.168:32825 dropped by fwchain_frag Reason: wait for more fragments;
Subsequent fragment frames will generate a generic drop that does not contain Proto / IP address / Ports:
fw_log_drop: Packet proto=-1 ?:0 -> ?:0 dropped by fwchain_frag Reason: wait for more fragments;
- Once the Firewall receives the final fragment, the packet is virtually reassembled in the kernel and processed through the rulebase.
The entry is deleted from the "
frag_table" kernel table.
- Once accepted by the firewall the original fragments are forwarded through the egress interface of the firewall. The firewall does not forward the virtually reassembled packet.
Note: When the Firewall egresses the original fragments, it might need to fragment once more based on the outbound interface's MTU. For example if the largest fragment received is 1400 bytes, but the egress interface has an MTU of 1300 then further fragmentation will need to take place on egress.