LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Networking (http://www.linuxquestions.org/questions/linux-networking-3/)
-   -   Iptables and NAT strange problem (http://www.linuxquestions.org/questions/linux-networking-3/iptables-and-nat-strange-problem-787594/)

shukalo83 02-07-2010 11:45 AM

Iptables and NAT strange problem
 
I'am trying to setup nat on RHEL4 box.

I have static ip address on eth0 and 192.168.60.1 address on privat LAN (eth1)

Also I have tap0 (192.168.168.1) interface enabled and working openvpn connection to all hosts in privat LAN (including NAT box)

I have done this numerous times before. Never the less, I have problem now and I am stuck.

Current situation is this:

Working ping to www.google.com from servers inside. Also working ping with -s 1472 (full size packet).

Telnet from inside machine to www.google.com 80 works but I can't get any messages after I get connected (Just successfull telnet connection)

From nat box all is ok.

I have tried to sniff traffic and I have seen ACK, SYN ACK, ACK packets when trying to hit www.google.com from inside. After that I have IP bad-len: 0 messages (When I see inside them, these look like packets from google with HTML tags but something is wrong with them)

I found that this can be tcpmss problem and done --clamp-mss-to-mtu stuff but that didn't work either.

What is the problem here? I dont see bugs on iptables version 1.2.11 that can have this kind of impact on traffic.

These are my iptables rules

Quote:

[root@natbox]# iptables -nvL
Chain INPUT (policy DROP 1729 packets, 105K bytes)
pkts bytes target prot opt in out source destination
611K 239M ACCEPT all -- eth0 * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
8311 795K ACCEPT all -- eth1 * 192.168.60.0/24 0.0.0.0/0
30548 2963K ACCEPT all -- tap0 * 192.168.168.0/24 0.0.0.0/0
48001 9271K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- eth0 * 192.168.60.0/24 0.0.0.0/0
0 0 DROP all -- eth0 * 127.0.0.0/8 0.0.0.0/0
0 0 ACCEPT tcp -- eth0 * allowed_ssh_ip 0.0.0.0/0 tcp dpt:22
149 6297 ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:1194
0 0 ACCEPT udp -- * * my_dns_server 0.0.0.0/0 udp spt:53

Chain FORWARD (policy DROP 28 packets, 1120 bytes)
pkts bytes target prot opt in out source destination
4741 472K ACCEPT all -- eth1 eth0 0.0.0.0/0 0.0.0.0/0
398K 177M ACCEPT all -- tap0 eth1 0.0.0.0/0 0.0.0.0/0
135 20160 ACCEPT all -- eth0 eth1 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
273K 87M ACCEPT all -- eth1 tap0 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT 544K packets, 139M bytes)
pkts bytes target prot opt in out source destination

[root@natbox]# iptables -nvL -t nat
Chain PREROUTING (policy ACCEPT 18221 packets, 1683K bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 19019 packets, 1435K bytes)
pkts bytes target prot opt in out source destination
3612 203K SNAT all -- * eth0 192.168.60.0/24 0.0.0.0/0 to:my_public_ip

Chain OUTPUT (policy ACCEPT 18070 packets, 1389K bytes)
pkts bytes target prot opt in out source destination

[root@natbox]# iptables -nvL -t mangle
Chain PREROUTING (policy ACCEPT 96895 packets, 30M bytes)
pkts bytes target prot opt in out source destination

Chain INPUT (policy ACCEPT 67263 packets, 18M bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 29470 packets, 12M bytes)
pkts bytes target prot opt in out source destination
15 900 TCPMSS tcp -- eth1 eth0 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU

Chain OUTPUT (policy ACCEPT 60095 packets, 15M bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 90014 packets, 27M bytes)
pkts bytes target prot opt in out source destination

Thank You

shukalo83 02-08-2010 02:06 AM

Anyone?

shukalo83 02-10-2010 04:44 AM

bump
 
bump!
Anyone?

I have dealt wiht the problem by using squid but this thing is bothering me.
Is there anyone who can actually tell that my iptables config is correct and that NAT with web traffic should work?

Cron0s 02-08-2012 06:06 AM

I had the same problem.
Maybe this link can help - http://tldp.org/HOWTO/IP-Masquerade-...tu-issues.html


All times are GMT -5. The time now is 08:32 AM.