> Source: [sk174323](https://support.checkpoint.com/results/sk/sk174323)

# sk174323 - Cannot open connections from the host: "SYN on established connection"

| Property | Value |
|----------|-------|
| Solution ID | sk174323 |
| Date Created | 2021-10-14 |
| Last Modified | 2026-06-27 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * The user cannot open a connection from the host. The Security Gateway drops the packets for this reason: 


  "`SYN On established connection`"

* The used established connection is stuck in the Security Gateway connection table, preventing connection re-use.

* In a configuration of multiple Security Gateways, the SYN packet is dropped on route in one of the Security Gateways as "`SYN on established connection`".

* There is an issue with the Client reusing a connection with the same source IP address, source port, destination IP address, and destination port.

* Smart Connection Reuse is disabled. see [sk24960](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk24960 "")

## Cause

When the Security Gateway encounters a TCP \[SYN\] packet which belongs to an already established connection, the TCP \[SYN\] packet refreshes the established connection's expiration time. As a result of the connection state (established), the Security Gateway drops the packet with "`SYN on established connection`", without replying to the Client.  

This frequently occurs when the state of the connection for the Client (Closed connection) is different from the state of the connection for the Security Gateway and the server (Open established connection).  

From the Security Gateway's perspective, the Client attempts to use the connection entry (source IP address, source port, destination IP address, and destination port) for a new connection, while a connection with the same entry exists in the Security Gateway's connection table and has not expired.  

The misaligned state between the Client and the Security Gateway / server might occur as a result of:  

* The connection was not closed by the Client or Server.
* The Client closed the connection by sending a TCP \[RST\] packet that did not reach the Security Gateway.
* The Client crashed, resetting the connection state.

If the Client endlessly attempts to open the connection with the same connection entry, the used established connection will continue to be in the Security Gateway's connection table, rendering the entry unusable.  

When there are multiple Security Gateways between the client and the server, a Security Gateway in route might silently drop the packet.   

<br />

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content