Thu Oct 01, 2009 9:18 pm
If the SYN packet comes in one router, gets put into the connection tracking on one router, and then leaves the other router, the first router won't see a complete connection and will start blocking things on the next inbound packets. Now you also have an outbound connection (reply) on the second router that looks new, but didn't start with a SYN packet. It's possible you could work around it by putting some rules in that just allowed everything, but that's not ideal and could get messy or complex when you need something else to work.