LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 02-07-2010, 10:45 AM   #1
shukalo83
LQ Newbie
 
Registered: Feb 2010
Posts: 4

Rep: Reputation: 0
Iptables and NAT strange problem


I'am trying to setup nat on RHEL4 box.

I have static ip address on eth0 and 192.168.60.1 address on privat LAN (eth1)

Also I have tap0 (192.168.168.1) interface enabled and working openvpn connection to all hosts in privat LAN (including NAT box)

I have done this numerous times before. Never the less, I have problem now and I am stuck.

Current situation is this:

Working ping to www.google.com from servers inside. Also working ping with -s 1472 (full size packet).

Telnet from inside machine to www.google.com 80 works but I can't get any messages after I get connected (Just successfull telnet connection)

From nat box all is ok.

I have tried to sniff traffic and I have seen ACK, SYN ACK, ACK packets when trying to hit www.google.com from inside. After that I have IP bad-len: 0 messages (When I see inside them, these look like packets from google with HTML tags but something is wrong with them)

I found that this can be tcpmss problem and done --clamp-mss-to-mtu stuff but that didn't work either.

What is the problem here? I dont see bugs on iptables version 1.2.11 that can have this kind of impact on traffic.

These are my iptables rules

Quote:
[root@natbox]# iptables -nvL
Chain INPUT (policy DROP 1729 packets, 105K bytes)
pkts bytes target prot opt in out source destination
611K 239M ACCEPT all -- eth0 * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
8311 795K ACCEPT all -- eth1 * 192.168.60.0/24 0.0.0.0/0
30548 2963K ACCEPT all -- tap0 * 192.168.168.0/24 0.0.0.0/0
48001 9271K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- eth0 * 192.168.60.0/24 0.0.0.0/0
0 0 DROP all -- eth0 * 127.0.0.0/8 0.0.0.0/0
0 0 ACCEPT tcp -- eth0 * allowed_ssh_ip 0.0.0.0/0 tcp dpt:22
149 6297 ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:1194
0 0 ACCEPT udp -- * * my_dns_server 0.0.0.0/0 udp spt:53

Chain FORWARD (policy DROP 28 packets, 1120 bytes)
pkts bytes target prot opt in out source destination
4741 472K ACCEPT all -- eth1 eth0 0.0.0.0/0 0.0.0.0/0
398K 177M ACCEPT all -- tap0 eth1 0.0.0.0/0 0.0.0.0/0
135 20160 ACCEPT all -- eth0 eth1 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
273K 87M ACCEPT all -- eth1 tap0 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT 544K packets, 139M bytes)
pkts bytes target prot opt in out source destination

[root@natbox]# iptables -nvL -t nat
Chain PREROUTING (policy ACCEPT 18221 packets, 1683K bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 19019 packets, 1435K bytes)
pkts bytes target prot opt in out source destination
3612 203K SNAT all -- * eth0 192.168.60.0/24 0.0.0.0/0 to:my_public_ip

Chain OUTPUT (policy ACCEPT 18070 packets, 1389K bytes)
pkts bytes target prot opt in out source destination

[root@natbox]# iptables -nvL -t mangle
Chain PREROUTING (policy ACCEPT 96895 packets, 30M bytes)
pkts bytes target prot opt in out source destination

Chain INPUT (policy ACCEPT 67263 packets, 18M bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 29470 packets, 12M bytes)
pkts bytes target prot opt in out source destination
15 900 TCPMSS tcp -- eth1 eth0 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU

Chain OUTPUT (policy ACCEPT 60095 packets, 15M bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 90014 packets, 27M bytes)
pkts bytes target prot opt in out source destination
Thank You
 
Old 02-08-2010, 01:06 AM   #2
shukalo83
LQ Newbie
 
Registered: Feb 2010
Posts: 4

Original Poster
Rep: Reputation: 0
Anyone?
 
Old 02-10-2010, 03:44 AM   #3
shukalo83
LQ Newbie
 
Registered: Feb 2010
Posts: 4

Original Poster
Rep: Reputation: 0
bump

bump!
Anyone?

I have dealt wiht the problem by using squid but this thing is bothering me.
Is there anyone who can actually tell that my iptables config is correct and that NAT with web traffic should work?
 
Old 02-08-2012, 05:06 AM   #4
Cron0s
LQ Newbie
 
Registered: Aug 2009
Posts: 1

Rep: Reputation: 0
I had the same problem.
Maybe this link can help - http://tldp.org/HOWTO/IP-Masquerade-...tu-issues.html
 
  


Reply

Tags
iptables, nat


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
strange NAT problem zsoltrenyi Linux - Networking 1 06-14-2006 03:21 AM
pppoe/nat/iptables working BUT strange setup HELP ALInux Linux - Networking 3 02-06-2006 01:37 PM
please help: strange problem with NAT??? cutejai Linux - Networking 3 12-16-2005 05:37 AM
strange nat problem KennyNotDead Linux - Networking 3 05-11-2005 12:21 PM
iptables - strange behaviour of nat?? shacky Linux - Networking 2 10-17-2004 10:44 AM


All times are GMT -5. The time now is 06:55 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration