iptables如何允许RST包通过？

FunFreeBSD

在iptables日志里看到很多被屏蔽的RST包：
Nov  5 01:00:28 localhost kernel: REJECT_TCP: IN=eth0 OUT= SRC=211.136.222.98 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=49 ID=32076 DF PROTO=TCP SPT=62272 DPT=80 WINDOW=33135 RES=0x00 RST URGP=0

用tcpdump抓包看到：
00:59:47.213323 IP 211.136.222.98.62272 > x.x.x.x.http: S 1532392334:1532392334(0) win 33135 <mss 1410,nop,nop,timestamp 1072857930 0,nop,wscale 1,nop,nop,sackOK>
00:59:50.585805 IP 211.136.222.98.62272 > x.x.x.x.http: S 1532392334:1532392334(0) win 33135 <mss 1410,nop,nop,timestamp 1072858268 0,nop,wscale 1,nop,nop,sackOK>
00:59:57.343157 IP 211.136.222.98.62272 > x.x.x.x.http: S 1532392334:1532392334(0) win 33135 <mss 1410,nop,nop,timestamp 1072858944 0,nop,wscale 1,nop,nop,sackOK>
01:00:10.848048 IP 211.136.222.98.62272 > x.x.x.x.http: S 1532392334:1532392334(0) win 33135 <mss 1410,nop,nop,timestamp 1072860295 0,nop,wscale 1,nop,nop,sackOK>
01:00:28.109680 IP 211.136.222.98.62272 > x.x.x.x.http: R 1532392335:1532392335(0) win 33135

看来像是正常连接，只是不知道为什么对方发了几次S，就直接发R了

有什么办法让最后的R通过，而不被拒绝呢？怎么才能正确识别这样的包，而不跟其他RST混淆

[ 本帖最后由 FunFreeBSD 于 2009-11-5 09:01 编辑 ]

FunFreeBSD

up