LinuxQuestions.org
Did you know LQ has a Linux Hardware Compatibility List?
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 05-22-2006, 09:50 AM   #1
front_sturm
LQ Newbie
 
Registered: May 2006
Posts: 4

Rep: Reputation: 0
some domains inaccessible, possibly masquerade or dns related


Howdy!

I've setup my home network consisting of 2(!) computers, with the "server" accessing the Internet via modem - ppp0 and sharing this connection with the client via eth0, using masquerade of course.
Now, at first it seems that all is fine and working, but it turns out that some domains are inaccessible from the client!
With those, all I get is a blank screen (with the 'connecting' or similar in the status bar), the result is the same whether the client runs Debian or WinXp.
Examples of inaccessible domains include opera, microsoft, realplayer (and a load of others).
I've investigated the problem a bit, and here's some output from the client:

>host opera.com
>opera.com is an alias for front. opera. com.
>front.opera. com has address 193.69. 116.18
>front.opera. com has address 193.69. 116.19
>front.opera. com has address 193.69. 116.22
>opera.com is an alias for front.opera.com.
>opera.com is an alias for front.opera.com.

Now, if I try to access opera.com or 193.69. 116.18 it fails as described, but putting 193.69. 116.19 in the address bar get me into the webpage.

Any ideas as to what have I forgotten about? All runs fine on the server and the resolv.conf files are identical and point to my ISP's DNS servers.

Iptables configuration on the server is presented below (feedback welcomed):

# Clear
iptables -X
iptables -P INPUT DROP
iptables -F INPUT

iptables -P OUTPUT ACCEPT
iptables -F OUTPUT

iptables -P FORWARD DROP
iptables -F FORWARD

iptables -t nat -F
iptables -t mangle -F

# Load modules
modprobe ipt_MASQUERADE

# Allow related traffic
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Open aMule ports
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -p tcp --dport 4662 -j ACCEPT

# Open loopback
iptables -A INPUT -i lo -j ACCEPT

# Allow pinging within the intranet
iptables -A INPUT -i eth0 -p icmp -j ACCEPT

#Open DHCP ports
iptables -A INPUT -i eth0 -p udp --dport 67 -j ACCEPT
iptables -A INPUT -i eth0 -p udp --dport 68 -j ACCEPT

#631 is CUPS
iptables -A INPUT -i eth0 -p tcp --dport 631 -j ACCEPT

# Intranet config
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
iptables -A FORWARD -i eth0 -o ppp0 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

echo 1 > /proc/sys/net/ipv4/ip_forward


ps. there should be a tripple "w" before opera.com, as I can't post url's within threads yet
 
Old 05-22-2006, 12:11 PM   #2
sin
LQ Newbie
 
Registered: Jun 2005
Location: UK
Distribution: Slackware
Posts: 28

Rep: Reputation: 15
looking at you FW script i cant see how any traffic from you client machine gets to the internet,

I think you need to modify your script to allow outgoing traffic from the LAN
 
Old 05-22-2006, 02:25 PM   #3
front_sturm
LQ Newbie
 
Registered: May 2006
Posts: 4

Original Poster
Rep: Reputation: 0
I thought these lines:

iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
iptables -A FORWARD -i eth0 -o ppp0 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
echo 1 > /proc/sys/net/ipv4/ip_forward

take care of that. Most of the traffic moves in&out no problem.

Further observations:
if I'll try to tracerout any of the unaccessible domains, the packets bounce between routers until the 30 hop limit is reached and traceroute finishes. If that ain't strange, I don't know what is.
 
Old 05-22-2006, 03:25 PM   #4
sin
LQ Newbie
 
Registered: Jun 2005
Location: UK
Distribution: Slackware
Posts: 28

Rep: Reputation: 15
try this


#!/bin/bash

ETH_INT=eth0
ETH_EXT=ppp0
HOMESUBNET=192.168.0.0/24

EXTERN_IP=`ifconfig $ETH_EXT | grep inet | cut -d : -f 2 | cut -d \ -f 1`

modprobe ipt_MASQUERADE

iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -t nat -A POSTROUTING -o $ETH_EXT -j SNAT --to $EXTERN_IP

echo "1" > /proc/sys/net/ipv4/ip_forward

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -i ! $ETH_EXT -j ACCEPT

#allow icmp traffic - ping, traceroute
iptables -A INPUT -i $ETH_INT -p icmp -j ACCEPT

#default policy(s)
iptables -P INPUT DROP
 
Old 05-23-2006, 04:27 AM   #5
front_sturm
LQ Newbie
 
Registered: May 2006
Posts: 4

Original Poster
Rep: Reputation: 0
Using SNAT instead of MASQUERADE - interesting idea and frankly speaking, I had my hopes high. Still, after trying out your script and another one, found at iptables-tutorial.frozentux.net/scripts/rc.firewall.txt the best I could come up with was the same result as with masquerade - most of the traffic flows alright, some domains remain inaccessible.

I also used yet another script for masquerade, found at ww.debian-administration.org/articles/23, with exactly the same results (which is logical, since all those scripts should enable connection sharing). This leads me to the suspicion that either it's my ISP or buggy drivers issue(or something?!). I'll try to switch the roles of server and client and possibly, try sharing the connection under MS.

It turns out I am able to bypass the problem if I setup a proxy on the server machine and direct traffic through it, but it's a pain if you know stuff should work and it doesn't.

Many thanks for your help, SiN!
 
  


Reply

Tags
dns, masquerade


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
GRUB error 2 and possibly related problem cajunaggie Linux - General 4 08-31-2007 05:08 AM
Strange possibly Amarok related problem futz Linux - Software 4 12-13-2005 11:44 AM
KDSKBENT Error -Nvidia Related... Possibly MTUTech Fedora 0 12-10-2004 06:38 PM
GLIBC_2.0 Error When installing Oracle 8i OR 9i - Possibly related to JRE 1.1.8 itfcfan Linux - Software 1 05-26-2004 09:43 AM
GLIBC_2.0 Error When installing Oracle 8i OR 9i - Possibly related to JRE 1.1.8 itfcfan Mandriva 5 04-23-2004 12:25 PM


All times are GMT -5. The time now is 07:43 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration