LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 07-19-2016, 08:16 AM   #1
ljbrits
LQ Newbie
 
Registered: Jul 2016
Posts: 7

Rep: Reputation: Disabled
iptables routing decision


Hi,

Is there a way to see/log why packets are dropped in the "routing decision" after the iptables NAT-PREROUTING chain?

I am pinging a host on network B and can see the ICMP packet entering this GW using tcpdump and can follow it up to NAT-PREROUTING. After that, in INPUT or FOWRWARD chains, the packet is gone. I do have a default route.

The strange thing is that I can ping a host on network C and every thing is peachy.

Any ideas?

Regards,
LJB
 
Old 07-19-2016, 01:44 PM   #2
lazydog
Senior Member
 
Registered: Dec 2003
Location: The Key Stone State
Distribution: CentOS Sabayon and now Gentoo
Posts: 1,249
Blog Entries: 3

Rep: Reputation: 194Reputation: 194
You have a DROP statement in you firewall somewhere and that is why it gets dropped.
You can log all dropped packets by simply placing a log rule before any DROP or REJECT rules.
Best to label the packet as to why it is being dropped. Is it just ping that is being dropped?
 
Old 07-19-2016, 07:38 PM   #3
sag47
Senior Member
 
Registered: Sep 2009
Location: Raleigh, NC
Distribution: Ubuntu, PopOS, Raspbian
Posts: 1,899
Blog Entries: 36

Rep: Reputation: 477Reputation: 477Reputation: 477Reputation: 477Reputation: 477
Here's an example of a logging rule before rejecting like lazydog mentions.

https://github.com/samrocketman/home....rules#L28-L29

https://github.com/samrocketman/home....rules#L37-L38

https://github.com/samrocketman/home....rules#L42-L43

https://github.com/samrocketman/home...bles.rules#L46

Rejections show up in dmesg or you can log them to a file.

Last edited by sag47; 07-19-2016 at 07:39 PM.
 
Old 07-20-2016, 03:45 AM   #4
pingu_penguin
Member
 
Registered: Aug 2004
Location: pune
Distribution: Slackware
Posts: 349

Rep: Reputation: 60
Hi,

Since you mentioned NAT-PREROUTING , I assume you are using port fowarding.

However a point to be noted is that if you are trying to ping a host behind the NAT , it wont work , since ping uses icmp

and icmp is not a routable protocol.
 
Old 07-20-2016, 05:37 AM   #5
sag47
Senior Member
 
Registered: Sep 2009
Location: Raleigh, NC
Distribution: Ubuntu, PopOS, Raspbian
Posts: 1,899
Blog Entries: 36

Rep: Reputation: 477Reputation: 477Reputation: 477Reputation: 477Reputation: 477
ICMP definitely traverses NAT.

Source: https://tools.ietf.org/html/rfc792

Edit: pingu I read that as "a host behind the NAT can't ping external hosts". I misunderstood your point.

Last edited by sag47; 07-20-2016 at 05:44 AM.
 
Old 07-20-2016, 05:43 AM   #6
pingu_penguin
Member
 
Registered: Aug 2004
Location: pune
Distribution: Slackware
Posts: 349

Rep: Reputation: 60
Oh my bad, I thought NAT just re-writes source/dest headers IP's and forwards them acc.

Thanks for the link.
 
Old 07-20-2016, 04:24 PM   #7
lazydog
Senior Member
 
Registered: Dec 2003
Location: The Key Stone State
Distribution: CentOS Sabayon and now Gentoo
Posts: 1,249
Blog Entries: 3

Rep: Reputation: 194Reputation: 194
I'm going to assume that because you talk about network C and network B and the rules you posted that you have more then one interface connected to two or more networks.

First off your rules. What's up with the -g you have in them Lines 52,54 and 152-181? I'm going to assume that your logs show these as errors.

Second. You need to give me some sort of direction your packet travels in order for me to follow your firewall rules to attempt to figure this out.
But I think I know where the problem is already. Your FORWARD rules.
Code:
#FORWARD Chain
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -j LOGGING
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
There is nothing allowing anything to pass. Sure you have an ESTABLISHED,RELATED rule but there is no NEW rule to add anything to the connection tracking db.
The last line doesn't allow anything to be forwarded.

You talk about this input rule but if you are coming in one interface and leaving on another the INPUT rules never see the packet.

This diagram should help with understanding Packet Flow;

If I am not understanding you correctly, please give more detail as to what interface the packet is coming in on and what interface the packet is leaving on. IP Addresses would also help a lot.
 
Old 07-21-2016, 01:09 AM   #8
sag47
Senior Member
 
Registered: Sep 2009
Location: Raleigh, NC
Distribution: Ubuntu, PopOS, Raspbian
Posts: 1,899
Blog Entries: 36

Rep: Reputation: 477Reputation: 477Reputation: 477Reputation: 477Reputation: 477
lazydog: The rules I posted are for the OP to show as an example of using logging in iptables. I think you're confusing me with the original poster. My firewall rules work just fine for my own uses.

Side note for lazydog: If you're curious about my firewall the man iptables page lists what the rules do. e.g. see -g or --goto in that page.
 
Old 07-21-2016, 08:16 PM   #9
lazydog
Senior Member
 
Registered: Dec 2003
Location: The Key Stone State
Distribution: CentOS Sabayon and now Gentoo
Posts: 1,249
Blog Entries: 3

Rep: Reputation: 194Reputation: 194
sag47: Yep, you are right I did confuse the two of you. And an old dog can learn something new.
 
Old 07-22-2016, 03:35 AM   #10
ljbrits
LQ Newbie
 
Registered: Jul 2016
Posts: 7

Original Poster
Rep: Reputation: Disabled
Thanks for all the replies and evolving discussion.

You are correct, I have two interfaces with packets being forwarded between them. The one connected to the internet also apply IPsec to the packet, but this irrelevant at this time since the packet never gets forwarded for encapsulation.

I did insert and append a unique logging rule to every chain (even at linklayer) and the logs show the packet last exited the NAT-PREROUTING chain and never at another chain after that. That is why I am asking for a way to see why the routing table might discard the packet. Again, the strange thing is that packets to network C gets forwarded.

Network B is 192.168.2.0/24 and network C is 192.168.3.0/24. I am pinging from 192.168.1.10.

Thanks for your time
Regards,
LJB
 
Old 07-22-2016, 12:16 PM   #11
lazydog
Senior Member
 
Registered: Dec 2003
Location: The Key Stone State
Distribution: CentOS Sabayon and now Gentoo
Posts: 1,249
Blog Entries: 3

Rep: Reputation: 194Reputation: 194
Would it be possible for you to share your rules?
 
Old 07-25-2016, 05:57 AM   #12
ljbrits
LQ Newbie
 
Registered: Jul 2016
Posts: 7

Original Poster
Rep: Reputation: Disabled
Hi lazydog,

I can but it is large and quite involved. Is this allowed by this forum?

Thanks
LJB
 
Old 07-26-2016, 10:04 AM   #13
lazydog
Senior Member
 
Registered: Dec 2003
Location: The Key Stone State
Distribution: CentOS Sabayon and now Gentoo
Posts: 1,249
Blog Entries: 3

Rep: Reputation: 194Reputation: 194
If nothing else you can use Pastebin to post your rules
 
Old 07-26-2016, 10:01 PM   #14
sag47
Senior Member
 
Registered: Sep 2009
Location: Raleigh, NC
Distribution: Ubuntu, PopOS, Raspbian
Posts: 1,899
Blog Entries: 36

Rep: Reputation: 477Reputation: 477Reputation: 477Reputation: 477Reputation: 477
I recommend wrapping your rules [code][/code] tags so that it's readable if you post it to the forum.
 
Old 07-27-2016, 04:36 AM   #15
ljbrits
LQ Newbie
 
Registered: Jul 2016
Posts: 7

Original Poster
Rep: Reputation: Disabled
The rules are at http://pastebin.com/Q3kVYvhq

I used iptables-save to get the chains and rules. I've changed some static IPs for privacy reasons. These rules was created for an older version of iptables, but still works.

Thanks for your help
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables output filter dropping packets before correct routing decision is made gmarthe Linux - Networking 0 03-06-2013 05:44 AM
Knowing when a packet is dropped due to a routing decision techmex Linux - Networking 6 01-30-2009 11:32 AM
iptables routing Jaidan Linux - Networking 1 10-09-2007 03:59 PM
routing decision and iptables eantoranz Linux - Networking 6 07-21-2005 10:21 AM
More Help routing with iptables LAR12345 Linux - Networking 2 02-02-2003 10:28 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 12:14 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration