LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 05-04-2004, 02:34 AM   #1
spede
LQ Newbie
 
Registered: Sep 2003
Posts: 7

Rep: Reputation: 0
Question Iptables blocking all traffic on other NIC


I have little problem with my debian and iptables.. I installed another NIC to my server (3com 3c905b) and all worked fine when I put on iptables.. Traffic will go through both NIC's couple of hours and after that iptables block all traffic from installed 3c905b.
Both cards are 3com 3c905b and they got their ip's from dhcp.. Can someone say what help to this problem?

Edit: Now it started to work and I didn't do nothing
Let's see how long it work now

Edit2: Now it block all traffic again.. Who know how I can fix this problem?

Edit3: IP works now, but I don't know how long.. When it works it work 1-2 hours and then all traffic go down for 3-4hours.. What can cause this

Last edited by spede; 05-04-2004 at 12:00 PM.
 
Old 05-04-2004, 09:19 PM   #2
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 57
Doesn't sound like the firewall unless you have the IP addresses hard-coded into the iptables script. Sounds more like a DHCP or routing+DHCP issue. See if the outages coincide with the system getting a new IP address lease.
 
Old 05-05-2004, 10:38 AM   #3
spede
LQ Newbie
 
Registered: Sep 2003
Posts: 7

Original Poster
Rep: Reputation: 0
Now it is sure that firewall is not blocking traffic.. I used tcpdump to eth1 and it says this when something start to block traffic:

18:24:03.131958 80.223.XXX.XXX.3703 > 80.223.1XX.XXX.135: S 3837510325:3837510325
(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
18:24:06.059505 80.223.XX.XXX.3703 > 80.223.1XX.XXX.135: S 3837510325:3837510325
(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
18:24:12.068381 80.223.XXX.XXX.3703 > 80.223.1XX.XXX.135: S 3837510325:3837510325
(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
18:24:28.584656 62.73.33.48.6667 > 80.223.1XX.XXX.33272: FP 0:108(108) ack 1 win
2896 <nop,nop,timestamp 539259193 2156662> (DF)
18:24:37.867088 80.223.1XX.XXX > 80.223.1XX.XXX: icmp: echo request
18:25:24.138067 80.223.1XX.XXX.4014 > 80.223.1XX.XXX.445: S 3881765756:388176575
6(0) win 64240 <mss 1460,nop,nop,sackOK> (DF)
18:25:27.095391 80.223.1XX.XXX.4014 > 80.223.1XX.XXX.445: S 3881765756:388176575
6(0) win 64240 <mss 1460,nop,nop,sackOK> (DF)
18:25:29.034455 81.35.129.147.3318 > 80.223.1XX.XXX.135: S 2524344233:2524344233
(0) win 16384 <mss 1452,nop,nop,sackOK> (DF)
18:25:32.584186 62.73.33.48.6667 > 80.223.1XX.XXX.33272: FP 0:108(108) ack 1 win
2896 <nop,nop,timestamp 539265593 2156662> (DF)
18:25:32.816215 81.35.129.147.3318 > 80.223.1XX.XXX.135: S 2524344233:2524344233
(0) win 16384 <mss 1452,nop,nop,sackOK> (DF)

Does this say anything to someone?
Edit: Those don't come when is traffic on eth1

Last edited by spede; 05-05-2004 at 11:09 AM.
 
Old 05-05-2004, 05:37 PM   #4
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 57
I'd guess that it looks like the packets are going off to nowhere, like the host is down or not responding (like if it had a new IP). Though it is very hard to tell what is going on because you didn't tell us what we are looking at (ie which machines have what IP (there are at least 4 different IPs), you smartly masked the IPs for the 80.223.1 machines but we cannot readily distinguish one from the other. What we do see is a number of syn packets being sent and re-sent and an icmp echo request, but no acks or icmp reply coming from either 80.223.1.

When you see this happening look at the IP addresses assigned to the various machines/cards and compare that with the packets. It might also be helpful to repost the above (or just edit it) and include an explanation of what the IPs correspond to and what is generating traffi, etc..

You might also just want to turn off you firewall temporarily when a disruption occurs, just to completely rule it out

Last edited by Capt_Caveman; 05-05-2004 at 05:38 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables blocking traffic JJX Linux - Networking 4 11-07-2005 05:36 AM
Blocking traffic fugzi Linux - Networking 2 12-04-2004 03:31 PM
Kernel 2.4.26, slack 8.0: blocking outgoing traffic coindood Linux - Networking 3 06-03-2004 10:15 PM
Blocking Traffic on a specific port (kazaa) GratePayne Linux - Security 4 05-09-2004 09:10 AM
firewall traffic blocking help jaylee Linux - Security 8 06-30-2003 10:44 AM


All times are GMT -5. The time now is 07:05 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration