Shorewall local redirect (DNAT with routeback Option)

[stiwi]

I have i strange problem. in my company is a shorewall router with configured local redirect for pop-3 and smtp. so users, conneting from extern to the companys pop-3 server with the public ip, localy can use the same ip.

the problem is, that the connection is sometimes resettet from the mailserver when i poll pop3 intern with the external ip. sometimes it works. when i intern use the internal ip, it works.

extern ip pop3 server: 111.111.111.111 (example)
intern ip pop3 server: 192.168.111.111
router internal ip: 192.168.111.1

shorewall config
interfeces:
net eth1 111.111.111.255
loc eth0 192.168.255.255 routeback

masq:
eth0:192.168.111.1 eth0 192.168.111.111 tcp pop3
eth0:192.168.111.1 eth0 192.168.111.111 udp pop3
eth0:192.168.111.1 eth0 192.168.111.111 tcp smtp
eth0:192.168.111.1 eth0 192.168.111.111 udp smtp

rules:
DNAT loc loc:192.168.111.1 tcp pop-3 - 111.111.111.111
DNAT loc loc:192.168.111.1 udp pop-3 - 111.111.111.111
DNAT loc loc:192.168.111.1 tcp smtp - 111.111.111.111
DNAT loc loc:192.168.111.1 udp smtp - 111.111.111.111

the example config is here: http://www.shorewall.net/FAQ.htm#id2452274

what can i do to find out the problems cause?

[thunder]

you should get more info by `tcpdump` or `tcpflow` and setting up

[stiwi]

Ok, here is my tcpdump. in line no. 149 starts mysterious duplicate ack packages. what can it be? on local pop-3 poll, there is no duplicate ack in the logfiles. i canceled the transfer after line 182, because is stalls.

111.111.111.111: External IP from the Mailserver
10.30.3.21: My PC
10.30.2.3: Router with local DNAT
10.30.2.1: Local IP from the Mailserver

tcpdump from the router: