Hi,
I'm pretty new to Linux, but not to networking or Windows, and this problem has got me completely confused, and wondered if anyone could shed some light on it.

First of all, this is my set up.

I have a mainly Windows XP network, all using internal addresses. We do have some Linux PC's which are used for development and have external addresses and connect directly out to the internet (behind a firewall).

The Windows PC's connect to the internet via a Linux server running Redhat AS 3.0, which has 2 network cards, one external, one internal. This server also has Squid V2.5 STABLE6 running on it.

Now up until last week, everything was fine, then for no apparent reason, the Windows PC's could not get to a couple of websites via HTTP, FTP or SSHing (using Putty) to their servers.

The Linux PC's have continued to work fine, and can reach these websites and their servers with no problems.

I tried elinks from the linux server these Windows PC's connect through, and I couldn't get to these particular sites either. When I tried SSH, that also failed to connect.

The odd thing is that if I issue a traceroute or dig from this server to these websites I get information back, which is correct.

I've tried restarting Squid and clearing its cache, but its made no difference, so I don't think the fault lies with Squid.

One curious thing about the server, is now and again it refuses SSH connections to it, then suddenly allows them again.

There are no errors on the network cards or on the switch it connects to.

It only affects a very few number of sites. I don't think the problem is at their end, as, like I mentioned, the Linux PC's can connect with no problem.

If anyone has any ideas what I could check for, I would be most grateful, as its even confused our resident Linux expert.

SSH behaviour is strange. All other seems looking similar to description of CONFIG_INET_ECN parameter in linux kernel: "to access a site behind such a firewall (some of which are major sites, at the time of this writing) you will have to disable this option". This can be done by modifying /proc/sys/net/ipv4/tcp_ecn . (probably you should type "echo 0 > /proc/sys/net/ipv4/tcp_ecn" in some startup file)