[arch-general] iptables not working well?
Hi, I've configured a 2-nics gateway (one internal nic and an external usb nic hooked to the adsl modem). I configured iptables as I'm used to do: ++++++ iptables-restore < /etc/iptables/empty.rules iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT iptables -F iptables -t nat -F iptables -t mangle -F iptables -X iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -m state --state NEW ! -i ppp0 -j ACCEPT iptables -A FORWARD -m state --state ESTABLISHED,RELATED -i ppp0 -o eth0 -j ACCEPT iptables -A FORWARD -i eth0 -o ppp0 -j ACCEPT iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE iptables -A FORWARD -i ppp0 -o ppp0 -j REJECT /etc/rc.d/iptables save /etc/rc.d/iptables restart ++++++ Notice that I have IP forwarding enabled through: ++++++ % 'grep' forward /etc/sysctl.conf net.ipv4.ip_forward=1 net.ipv6.conf.all.forwarding=1 ++++++ And also through: ++++++ % 'grep' FORWARD /etc/conf.d/iptables IPTABLES_FORWARD=1 ++++++ But I can confirm by: +++++++ % cat /proc/sys/net/ipv4/ip_forward 1 +++++++ This is based upon: http://www.debian-administration.org/articles/23 And it's working on a debian box. I remember some time back it also worked on a arch box, only thing I was not using pppd directly but wvdial instead... OK, on machines at the internal side of my LAN, I can ping everywhere. But I can not use the browser with all addresses, for example I can't get to www.archlinux.org through frirefox or midori, neither www.debian.org. Weird thing www.google.com, and some other sites can be reached through firefox on machines inside the LAN. When I try accessing those sites on the gateway (not the machines inside the LAN) of course I have no problem. I checked /etc/resolv.con, and it's OK, besides ping has clear access everywhere. I have no clue what's going on. I noticed the following under /var/log/messages.log: +++++++ Jul 9 23:32:33 mini-0 pppd[1974]: Plugin rp-pppoe.so loaded. Jul 9 23:32:33 mini-0 pppd[1974]: RP-PPPoE plugin version 3.8p compiled against pppd 2.4.5 Jul 9 23:32:34 mini-0 kernel: NET: Registered protocol family 10 Jul 9 23:32:34 mini-0 pppd[1974]: pppd 2.4.5 started by root, uid 0 Jul 9 23:32:34 mini-0 pppd[1974]: PPP session is 45128 Jul 9 23:32:34 mini-0 pppd[1974]: Connected to 00:12:7f:33:eb:3c via interface eth1 Jul 9 23:32:34 mini-0 pppd[1974]: Using interface ppp0 Jul 9 23:32:34 mini-0 pppd[1974]: Connect: ppp0 <--> eth1 Jul 9 23:32:34 mini-0 pppd[1974]: PAP authentication succeeded Jul 9 23:32:34 mini-0 pppd[1974]: peer from calling number 00:12:7F:33:EB:3C authorized Jul 9 23:32:34 mini-0 pppd[1974]: kernel does not support PPP filtering Jul 9 23:32:34 mini-0 pppd[1974]: local IP address 201.200.139.27 Jul 9 23:32:34 mini-0 pppd[1974]: remote IP address 200.91.104.9 Jul 9 23:32:34 mini-0 pppd[1974]: primary DNS address 200.91.75.6 Jul 9 23:32:34 mini-0 pppd[1974]: secondary DNS address 200.91.75.5 Jul 9 23:32:35 mini-0 kernel: ip_tables: (C) 2000-2006 Netfilter Core Team Jul 9 23:32:35 mini-0 kernel: nf_conntrack version 0.5.0 (7628 buckets, 30512 max) +++++++ It sounded curious that kernel does not support PPP filtering, but I'm almost certain that's not the issue, given that on the gateway (not the forwarded internal LAN), I can access all pages through firefox... Any help you can provide is very welcome... It might be the iptables is not working well. I missed to indicate this is running on a lemote mini-pc (archloong on mipsel), which of course has no official support, but I wanted to see first if I'm missing any configuration particular to arch (as I said this worked before also on a x86 arch box, but things change), so just in case perhaps someone identified the miss... Thanks, -- Javier.
Your config looks ok, but to double check, paste the output of: iptables -L -nv iptables -t nat -L -nv to see the exact situation.
OK, on machines at the internal side of my LAN, I can ping everywhere. But I can not use the browser with all addresses, for example I can't get to www.archlinux.org through frirefox or midori, neither www.debian.org.
Weird thing www.google.com, and some other sites can be reached through firefox on machines inside the LAN.
What's the error you are getting. Are you ping-ing by name or by an IP address. Have you tried ping-ing with different packet sizes? on your gateway machine run tcpdump on both the LAN and ppp0 interface and see if the packets go through. -- damjan
On Sun, Jul 10, 2011 at 6:25 PM, Damjan Georgievski <gdamjan@gmail.com> wrote:
Your config looks ok, but to double check, paste the output of: iptables -L -nv iptables -t nat -L -nv to see the exact situation.
OK, on machines at the internal side of my LAN, I can ping everywhere. But I can not use the browser with all addresses, for example I can't get to www.archlinux.org through frirefox or midori, neither www.debian.org.
Weird thing www.google.com, and some other sites can be reached through firefox on machines inside the LAN.
What's the error you are getting. Are you ping-ing by name or by an IP address. Have you tried ping-ing with different packet sizes?
No error at all, just that the browser gets waiting to connect, and nevers does it. Pinging is always fine with no specification of packet size.
on your gateway machine run tcpdump on both the LAN and ppp0 interface and see if the packets go through.
I might try that. What I'll do for now is enable new connections on both sides, since the ones coming from outside are not accepted (but that's the way that sounds common sense to me, and that has been working on my debian box for quiet a while)... Again, no error, just the browser not getting anywhere for some sites. Some others work as google and gmail...
-- damjan
Thanks, -- Javier.
On Sun, Jul 10, 2011 at 10:22 PM, Javier Vasquez <j.e.vasquez.v@gmail.com> wrote:
On Sun, Jul 10, 2011 at 6:25 PM, Damjan Georgievski <gdamjan@gmail.com> wrote:
Your config looks ok, but to double check, paste the output of: iptables -L -nv
% sudo iptables -L -nv Password: Chain INPUT (policy ACCEPT 1 packets, 446 bytes) pkts bytes target prot opt in out source destination 48 4585 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 167 32532 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 1 60 ACCEPT all -- !ppp0 * 0.0.0.0/0 0.0.0.0/0 state NEW Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 305 185K ACCEPT all -- ppp0 eth0 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 358 117K ACCEPT all -- eth0 ppp0 0.0.0.0/0 0.0.0.0/0 0 0 REJECT all -- ppp0 ppp0 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable Chain OUTPUT (policy ACCEPT 254 packets, 23099 bytes) pkts bytes target prot opt in out source destination
iptables -t nat -L -nv
% sudo iptables -t nat -L -nv Chain PREROUTING (policy ACCEPT 59 packets, 7366 bytes) pkts bytes target prot opt in out source destination Chain INPUT (policy ACCEPT 2 packets, 506 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 74 packets, 4284 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 4 packets, 208 bytes) pkts bytes target prot opt in out source destination 127 10936 MASQUERADE all -- * ppp0 0.0.0.0/0 0.0.0.0/0
to see the exact situation.
...
What's the error you are getting. Are you ping-ing by name or by an IP address. Have you tried ping-ing with different packet sizes?
No error at all, just that the browser gets waiting to connect, and nevers does it. Pinging is always fine with no specification of packet size.
OK, I forgot to answer properly... Yes, I'm using names, not ips... I didn't try different sizes, but I've done it now...
From a machine inside the gateway:
% ping -s 1464 www.archlinux.org PING gudrun.archlinux.org (66.211.214.131): 1464 data bytes 1472 bytes from 66.211.214.131: icmp_seq=0 ttl=52 time=143.214 ms 1472 bytes from 66.211.214.131: icmp_seq=1 ttl=52 time=142.794 ms 1472 bytes from 66.211.214.131: icmp_seq=2 ttl=52 time=142.594 ms ^C--- gudrun.archlinux.org ping statistics --- 3 packets transmitted, 3 packets received, 0% packet loss round-trip min/avg/max/stddev = 142.594/142.867/143.214/0.258 ms % ping -s 1465 www.archlinux.org PING gudrun.archlinux.org (66.211.214.131): 1465 data bytes ^C--- gudrun.archlinux.org ping statistics --- 11 packets transmitted, 0 packets received, 100% packet loss When the size is 1465, which corresponds to 1473 bytes packets, I get no answer. But the same happens on the gateway, so this doesn't seem to be an issue. Not so clear to me, sizes of 0 specified still work, and from 0 to 1464 ping is OK... It's weird to me that I can ping the names, but I can't access them through web browser. And even more weird that some sites are able to be accessed through the web browser... I might try later what was suggested about logging... -- Javier.
participants (2)
-
Damjan Georgievski
-
Javier Vasquez