| shukalo83 |
02-07-2010 10:45 AM |
Iptables and NAT strange problem
I'am trying to setup nat on RHEL4 box.
I have static ip address on eth0 and 192.168.60.1 address on privat LAN (eth1)
Also I have tap0 (192.168.168.1) interface enabled and working openvpn connection to all hosts in privat LAN (including NAT box)
I have done this numerous times before. Never the less, I have problem now and I am stuck.
Current situation is this:
Working ping to www.google.com from servers inside. Also working ping with -s 1472 (full size packet).
Telnet from inside machine to www.google.com 80 works but I can't get any messages after I get connected (Just successfull telnet connection)
From nat box all is ok.
I have tried to sniff traffic and I have seen ACK, SYN ACK, ACK packets when trying to hit www.google.com from inside. After that I have IP bad-len: 0 messages (When I see inside them, these look like packets from google with HTML tags but something is wrong with them)
I found that this can be tcpmss problem and done --clamp-mss-to-mtu stuff but that didn't work either.
What is the problem here? I dont see bugs on iptables version 1.2.11 that can have this kind of impact on traffic.
These are my iptables rules
Quote:
[root@natbox]# iptables -nvL
Chain INPUT (policy DROP 1729 packets, 105K bytes)
pkts bytes target prot opt in out source destination
611K 239M ACCEPT all -- eth0 * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
8311 795K ACCEPT all -- eth1 * 192.168.60.0/24 0.0.0.0/0
30548 2963K ACCEPT all -- tap0 * 192.168.168.0/24 0.0.0.0/0
48001 9271K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- eth0 * 192.168.60.0/24 0.0.0.0/0
0 0 DROP all -- eth0 * 127.0.0.0/8 0.0.0.0/0
0 0 ACCEPT tcp -- eth0 * allowed_ssh_ip 0.0.0.0/0 tcp dpt:22
149 6297 ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:1194
0 0 ACCEPT udp -- * * my_dns_server 0.0.0.0/0 udp spt:53
Chain FORWARD (policy DROP 28 packets, 1120 bytes)
pkts bytes target prot opt in out source destination
4741 472K ACCEPT all -- eth1 eth0 0.0.0.0/0 0.0.0.0/0
398K 177M ACCEPT all -- tap0 eth1 0.0.0.0/0 0.0.0.0/0
135 20160 ACCEPT all -- eth0 eth1 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
273K 87M ACCEPT all -- eth1 tap0 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
Chain OUTPUT (policy ACCEPT 544K packets, 139M bytes)
pkts bytes target prot opt in out source destination
[root@natbox]# iptables -nvL -t nat
Chain PREROUTING (policy ACCEPT 18221 packets, 1683K bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 19019 packets, 1435K bytes)
pkts bytes target prot opt in out source destination
3612 203K SNAT all -- * eth0 192.168.60.0/24 0.0.0.0/0 to:my_public_ip
Chain OUTPUT (policy ACCEPT 18070 packets, 1389K bytes)
pkts bytes target prot opt in out source destination
[root@natbox]# iptables -nvL -t mangle
Chain PREROUTING (policy ACCEPT 96895 packets, 30M bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 67263 packets, 18M bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 29470 packets, 12M bytes)
pkts bytes target prot opt in out source destination
15 900 TCPMSS tcp -- eth1 eth0 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 60095 packets, 15M bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 90014 packets, 27M bytes)
pkts bytes target prot opt in out source destination
|
Thank You |
