Incoming LAN TCP connections dropped (No SYN-ACK) despite empty nftables and rp_filter=0
@Ivan
·
2026-05-02
·
via CachyOS Forum - Latest posts
Hello CachyOS community. I am experiencing a severe local network isolation issue on CachyOS. My machine completely ignores incoming TCP connections from my local network (e.g., from a smartphone to the PC), while ICMP (ping) works perfectly in both directions. The Setup & Problem: OS: CachyOS x86_64 (Kernel 7.0.2-2-cachyos) NIC: Realtek RTL8111H ( enp5s0 ) Scenario: Running a simple HTTP server ( python3 -m http.server 8000 --bind 192.168.50.104 ) or AudioRelay/Jellyfin. Result: Trying to access the server from a smartphone ( 192.168.50.88 ) on the same LAN results in ERR_CONNECTION_RESET or a Timeout. Troubleshooting already performed: To isolate the issue, I completely stripped down the network stack to a “bare metal” state: Services: Completely stopped and masked Docker, Cloudflare WARP ( warp-svc ), and DPI bypass tools ( zapret2 ). Routing: Flushed custom ip rule . The routing table is clean (only local , main , default remain). Firewall: Flushed everything. sudo nft flush ruleset , iptables -F , iptables -t nat -F , iptables -t mangle -F , iptables -t raw -F . Default policies set to ACCEPT . Sysctl Tweaks: Disabled reverse path filtering to prevent asymmetric routing drops: net.ipv4.conf.all.rp_filter=0 net.ipv4.conf.enp5s0.rp_filter=0 net.ipv4.conf.all.accept_local=1 Security: Stopped and disabled apparmor . Diagnostic Proof (tcpdump): Running sudo tcpdump -i enp5s0 -n tcp port 8000 shows that the SYN packets from the phone reach the network card, but the CachyOS kernel never replies with a SYN-ACK . It just silently drops the packets or actively resets them: 03:14:53.648346 IP 192.168.50.88.50758 > 192.168.50.104.8000: Flags [S], seq 3700488905, win 65535, options[mss 1460,sackOK,TS val 36956148 ecr 0,nop,wscale 8], length 0 03:14:54.648488 IP 192.168.50.88.50758 > 192.168.50.104.8000: Flags [S], seq 3700488905, win 65535, options[mss 1460,sackOK,TS val 36956449 ecr 0,nop,wscale 8], length 0 03:14:56.651726 IP 192.168.50.88.50758 > 192.168.50.104.8000: Flags [S], seq 3700488905, win 65535, options[mss 1460,sackOK,TS val 36957050 ecr 0,nop,wscale 8], length 0 (No outgoing SYN-ACK responses at all). Meanwhile, DLNA (SSDP multicast) is also broken for the exact same reason (the system sends multicast packets, the receiver answers, but CachyOS drops the incoming responses). On Windows 10 (Dual-Boot on the exact same hardware/router), everything works flawlessly out of the box. My Question: Is there any specific kernel hardening patch (like BORE scheduler networking tweaks), hidden cachyos-settings parameter, or a known issue with the r8169 driver in the current 7.0.x kernel that actively drops incoming unestablished TCP connections on non-privileged ports even when the firewall is completely disabled? I have attached the output of my cachyos-bugreport.sh below. Any help pointing me in the right direction would be greatly appreciated. [Here I will attach the output of cachyos-bugreport.sh] paste.cachyos.org c3c3b13 Author: Gunwant Jain, A highly opinionated and minimalistic Pastebin.
此内容由惯性聚合(RSS阅读器)自动聚合整理,仅供阅读参考。 原文来自 — 版权归原作者所有。