LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 09-10-2016, 04:13 AM   #1
Lockywolf
Member
 
Registered: Jul 2007
Posts: 655

Rep: Reputation: 233Reputation: 233Reputation: 233
Custom-built router/wifi-AP, can ping, can't load websites.


Hello, friends.

I have a weird problem.

I am building my own home server.

I have an old machine (~2gb of RAM, Celeron 430).

It is connected to my ISP's LAN (parameters obtained via DHCPcd).

To connect to the outer world, my ISP suggests PPPoE. I use RP-PPPOE, which gives me a point-to-point "real" ip.

Then I want this machine to work as a router/AP for my home.

I have a Linksys, Realtek-based wireless card, which uses serialmonkey's rl2800 driver. I use hostapd to set up an AP in b/g/n mode.

I have no encryption turned on.

Then I use dhcpd to serve ip addresses to my wireless network. I also forward my isp's DNS ips to my wireless clients.

On the machine I have super-minimalistic NAT rules:

Code:
bash-4.1# iptables -t nat --list
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  192.168.3.0/24       anywhere            
bash-4.1#
The weird problem is: most websites don't load! That is, I can access some even fairly heavy websites, like GMail, but most websites will hang on the "waiting" stage in Firefox.

Ping and traceroute/tracert work fine for both ips and names, from both my windows client and my linux server (this machine).

The same windows machine works well with other wireless access points.

Weird. How can I debug this system? Any suggestions?
 
Old 09-11-2016, 02:26 PM   #2
IsaacKuo
Senior Member
 
Registered: Apr 2004
Location: Baton Rouge, Louisiana, USA
Distribution: Debian Stable
Posts: 2,546
Blog Entries: 8

Rep: Reputation: 465Reputation: 465Reputation: 465Reputation: 465Reputation: 465
I don't know if it makes a difference, but when I use the same command to my functioning router (wired ethernet to wired ethernet), it returns this for Chain POSTROUTING:
Code:
Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  anywhere             anywhere
The difference is that the source is not restricted to the local addresses. The iptables commands I used are:
Code:
iptables -A INPUT -i eth0 -j ACCEPT
iptables -A INPUT -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 80   -j ACCEPT
iptables -P INPUT DROP

iptables -A FORWARD -i eth0 -s 192.168.1.0/255.255.255.0 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
Assuming your iptables are set up properly for ipv4, my guess is that maybe there's something wrong with the ipv6 setup (which would use ip6tables rather than iptables). I haven't felt like learning ipv6 yet, so I just drop it all (for now).

But as I understand it, Windows likes to use ipv6 by default if it's available, so maybe it is trying to access various web sites via ipv6 and as a result those are the ones which are failing. Maybe?
 
Old 09-15-2016, 05:27 AM   #3
Lockywolf
Member
 
Registered: Jul 2007
Posts: 655

Original Poster
Rep: Reputation: 233Reputation: 233Reputation: 233
Well, I turned Ipv6 off everywhere, both on my Linux router and my windows client. The problem persists.

This is how my tcpdump looks like when I try to access yahoo.com:

Code:
11:58:22.632780 IP Strannik.ultra.net.ru.50157 > ir2.fp.vip.bf1.yahoo.com.https: Flags [F.], seq 3260670969, ack 2021147468, win 64, length 0
11:58:22.658691 IP Strannik.ultra.net.ru.59270 > ir2.fp.vip.bf1.yahoo.com.https: Flags [S], seq 170027957, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
11:58:22.814363 IP ir2.fp.vip.bf1.yahoo.com.https > Strannik.ultra.net.ru.59270: Flags [S.], seq 3077166206, ack 170027958, win 8192, options [mss 1460,nop,nop,sackOK,nop,wscale 8], length 0
11:58:22.899171 IP Strannik.ultra.net.ru.59271 > ir2.fp.vip.bf1.yahoo.com.https: Flags [S], seq 4068100406, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
11:58:22.900642 IP Strannik.ultra.net.ru.59270 > ir2.fp.vip.bf1.yahoo.com.https: Flags [.], ack 1, win 64, length 0
11:58:22.901334 IP Strannik.ultra.net.ru.59270 > ir2.fp.vip.bf1.yahoo.com.https: Flags [P.], seq 1:192, ack 1, win 64, length 191
11:58:23.056334 IP ir2.fp.vip.bf1.yahoo.com.https > Strannik.ultra.net.ru.59271: Flags [S.], seq 3270283911, ack 4068100407, win 8192, options [mss 1460,nop,nop,sackOK,nop,wscale 8], length 0
11:58:23.057129 IP ir2.fp.vip.bf1.yahoo.com.https > Strannik.ultra.net.ru.59270: Flags [.], ack 192, win 62, length 0
11:58:23.058215 IP ir2.fp.vip.bf1.yahoo.com.https > Strannik.ultra.net.ru.59270: Flags [P.], seq 2921:4097, ack 192, win 62, length 1176
11:58:23.116298 IP Strannik.ultra.net.ru.59270 > ir2.fp.vip.bf1.yahoo.com.https: Flags [.], ack 1, win 64, options [nop,nop,sack 1 {2921:4097}], length 0
11:58:23.116345 IP Strannik.ultra.net.ru.59271 > ir2.fp.vip.bf1.yahoo.com.https: Flags [.], ack 1, win 64, length 0
11:58:23.116515 IP Strannik.ultra.net.ru.59271 > ir2.fp.vip.bf1.yahoo.com.https: Flags [P.], seq 1:192, ack 1, win 64, length 191
11:58:23.258160 IP Strannik.ultra.net.ru.50157 > ir2.fp.vip.bf1.yahoo.com.https: Flags [F.], seq 0, ack 1, win 64, length 0
11:58:23.274030 IP ir2.fp.vip.bf1.yahoo.com.https > Strannik.ultra.net.ru.59271: Flags [.], ack 192, win 62, length 0
11:58:23.275024 IP ir2.fp.vip.bf1.yahoo.com.https > Strannik.ultra.net.ru.59271: Flags [P.], seq 2921:4097, ack 192, win 62, length 1176
11:58:23.282754 IP Strannik.ultra.net.ru.59271 > ir2.fp.vip.bf1.yahoo.com.https: Flags [.], ack 1, win 64, options [nop,nop,sack 1 {2921:4097}], length 0
11:58:23.440967 IP ir2.fp.vip.bf1.yahoo.com.https > Strannik.ultra.net.ru.59271: Flags [P.], seq 5557:7001, ack 192, win 62, length 1444
11:58:23.729805 IP Strannik.ultra.net.ru.59271 > ir2.fp.vip.bf1.yahoo.com.https: Flags [.], ack 1, win 64, options [nop,nop,sack 2 {5557:7001}{2921:4097}], length 0
11:58:24.417279 IP Strannik.ultra.net.ru.50157 > ir2.fp.vip.bf1.yahoo.com.https: Flags [F.], seq 0, ack 1, win 64, length 0
11:58:26.727884 IP Strannik.ultra.net.ru.50157 > ir2.fp.vip.bf1.yahoo.com.https: Flags [F.], seq 0, ack 1, win 64, length 0
11:58:31.355461 IP Strannik.ultra.net.ru.50157 > ir2.fp.vip.bf1.yahoo.com.https: Flags [F.], seq 0, ack 1, win 64, length 0
11:58:33.120558 IP Strannik.ultra.net.ru.59270 > ir2.fp.vip.bf1.yahoo.com.https: Flags [.], seq 191:192, ack 1, win 64, length 1
11:58:33.276382 IP ir2.fp.vip.bf1.yahoo.com.https > Strannik.ultra.net.ru.59270: Flags [.], ack 192, win 62, options [nop,nop,sack 1 {191:192}], length 0
11:58:33.733430 IP Strannik.ultra.net.ru.59271 > ir2.fp.vip.bf1.yahoo.com.https: Flags [.], seq 191:192, ack 1, win 64, length 1
11:58:33.892200 IP ir2.fp.vip.bf1.yahoo.com.https > Strannik.ultra.net.ru.59271: Flags [.], ack 192, win 62, options [nop,nop,sack 1 {191:192}], length 0

on the external interface (ppp0)

Code:
11:58:22.632780 IP Strannik.ultra.net.ru.50157 > ir2.fp.vip.bf1.yahoo.com.https: Flags [F.], seq 3260670969, ack 2021147468, win 64, length 0
11:58:22.658691 IP Strannik.ultra.net.ru.59270 > ir2.fp.vip.bf1.yahoo.com.https: Flags [S], seq 170027957, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
11:58:22.814363 IP ir2.fp.vip.bf1.yahoo.com.https > Strannik.ultra.net.ru.59270: Flags [S.], seq 3077166206, ack 170027958, win 8192, options [mss 1460,nop,nop,sackOK,nop,wscale 8], length 0
11:58:22.899171 IP Strannik.ultra.net.ru.59271 > ir2.fp.vip.bf1.yahoo.com.https: Flags [S], seq 4068100406, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
11:58:22.900642 IP Strannik.ultra.net.ru.59270 > ir2.fp.vip.bf1.yahoo.com.https: Flags [.], ack 1, win 64, length 0
11:58:22.901334 IP Strannik.ultra.net.ru.59270 > ir2.fp.vip.bf1.yahoo.com.https: Flags [P.], seq 1:192, ack 1, win 64, length 191
11:58:23.056334 IP ir2.fp.vip.bf1.yahoo.com.https > Strannik.ultra.net.ru.59271: Flags [S.], seq 3270283911, ack 4068100407, win 8192, options [mss 1460,nop,nop,sackOK,nop,wscale 8], length 0
11:58:23.057129 IP ir2.fp.vip.bf1.yahoo.com.https > Strannik.ultra.net.ru.59270: Flags [.], ack 192, win 62, length 0
11:58:23.058215 IP ir2.fp.vip.bf1.yahoo.com.https > Strannik.ultra.net.ru.59270: Flags [P.], seq 2921:4097, ack 192, win 62, length 1176
11:58:23.116298 IP Strannik.ultra.net.ru.59270 > ir2.fp.vip.bf1.yahoo.com.https: Flags [.], ack 1, win 64, options [nop,nop,sack 1 {2921:4097}], length 0
11:58:23.116345 IP Strannik.ultra.net.ru.59271 > ir2.fp.vip.bf1.yahoo.com.https: Flags [.], ack 1, win 64, length 0
11:58:23.116515 IP Strannik.ultra.net.ru.59271 > ir2.fp.vip.bf1.yahoo.com.https: Flags [P.], seq 1:192, ack 1, win 64, length 191
11:58:23.258160 IP Strannik.ultra.net.ru.50157 > ir2.fp.vip.bf1.yahoo.com.https: Flags [F.], seq 0, ack 1, win 64, length 0
11:58:23.274030 IP ir2.fp.vip.bf1.yahoo.com.https > Strannik.ultra.net.ru.59271: Flags [.], ack 192, win 62, length 0
11:58:23.275024 IP ir2.fp.vip.bf1.yahoo.com.https > Strannik.ultra.net.ru.59271: Flags [P.], seq 2921:4097, ack 192, win 62, length 1176
11:58:23.282754 IP Strannik.ultra.net.ru.59271 > ir2.fp.vip.bf1.yahoo.com.https: Flags [.], ack 1, win 64, options [nop,nop,sack 1 {2921:4097}], length 0
11:58:23.440967 IP ir2.fp.vip.bf1.yahoo.com.https > Strannik.ultra.net.ru.59271: Flags [P.], seq 5557:7001, ack 192, win 62, length 1444
11:58:23.729805 IP Strannik.ultra.net.ru.59271 > ir2.fp.vip.bf1.yahoo.com.https: Flags [.], ack 1, win 64, options [nop,nop,sack 2 {5557:7001}{2921:4097}], length 0
11:58:24.417279 IP Strannik.ultra.net.ru.50157 > ir2.fp.vip.bf1.yahoo.com.https: Flags [F.], seq 0, ack 1, win 64, length 0
11:58:26.727884 IP Strannik.ultra.net.ru.50157 > ir2.fp.vip.bf1.yahoo.com.https: Flags [F.], seq 0, ack 1, win 64, length 0
11:58:31.355461 IP Strannik.ultra.net.ru.50157 > ir2.fp.vip.bf1.yahoo.com.https: Flags [F.], seq 0, ack 1, win 64, length 0
11:58:33.120558 IP Strannik.ultra.net.ru.59270 > ir2.fp.vip.bf1.yahoo.com.https: Flags [.], seq 191:192, ack 1, win 64, length 1
11:58:33.276382 IP ir2.fp.vip.bf1.yahoo.com.https > Strannik.ultra.net.ru.59270: Flags [.], ack 192, win 62, options [nop,nop,sack 1 {191:192}], length 0
11:58:33.733430 IP Strannik.ultra.net.ru.59271 > ir2.fp.vip.bf1.yahoo.com.https: Flags [.], seq 191:192, ack 1, win 64, length 1
11:58:33.892200 IP ir2.fp.vip.bf1.yahoo.com.https > Strannik.ultra.net.ru.59271: Flags [.], ack 192, win 62, options [nop,nop,sack 1 {191:192}], length 0
Where do these 'sack' guys come from?
 
Old 09-22-2016, 04:07 AM   #4
Lockywolf
Member
 
Registered: Jul 2007
Posts: 655

Original Poster
Rep: Reputation: 233Reputation: 233Reputation: 233
So I did found the issue.

It's quite a famous issue called "PMTU Discovery Black Hole". (Googlable)

TLDR; solution is:

Code:
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS  --clamp-mss-to-pmtu
 
  


Reply

Tags
dhcp, hostapd, nat, routing


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Wifi connected to router, ping to router ok, no webaccess. what is wrong? deepcore Linux - Wireless Networking 5 01-07-2008 02:59 AM
wifi adhoc without router can't share internet can ping fani Linux - Wireless Networking 3 05-28-2007 07:25 AM
Ping websites but they wont load Kane2002 Linux - Networking 10 10-09-2006 04:12 AM
pls help: debian router => some websites won't load (though pinging works) mikey79 Linux - Networking 3 07-15-2006 12:23 PM
Websites load slow, but once they load, any links inside them load fast smurcoch Mandriva 3 02-06-2006 01:47 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 08:14 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration