Re: IPTables Problem: I think I figured it out... [was IPTables Established connection Problem]
From: Ian Jones (ian@dsl081-056-052.sfo1.dsl.speakeasy.net)Date: 12/19/01
- Next message: Doubletwist: "Re: IPTables Problem: I think I figured it out... [was IPTables"
- Previous message: Tim Haynes: "Re: IPTables Problem: I think I figured it out... [was IPTables Established connection Problem]"
- In reply to: Tim Haynes: "Re: IPTables Problem: I think I figured it out... [was IPTables Established connection Problem]"
- Next in thread: Doubletwist: "Re: IPTables Problem: I think I figured it out... [was IPTables"
- Reply: Doubletwist: "Re: IPTables Problem: I think I figured it out... [was IPTables"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: Ian Jones <ian@dsl081-056-052.sfo1.dsl.speakeasy.net> Date: Tue, 18 Dec 2001 17:27:09 -0800
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> Doubletwist <dontspam.doubletwist@spack.nu> writes:
>
>> Turns out that though my workstation has a public IP, it is routed
>> through three hops that have a private IP. [not sure why]
>>
>> So my server was dropping those connections.
>
> My betting is that something like an ICMP 3/4 `frag required' packet is
> coming back, maybe from one of those routers, and because it's coming from
> a private IP#, conntrack is somehow not relating it to the outgoing
> connection.
>
> Out of interest, and a slightly voodoo suggestion, does dropping your MTU
> to e.g. 576 make any difference?
I'm sure conntrack is not the problem here. I also don't think it has
anything to do with what the IP address is...bits is bits. The system
and the network doesn't really care what the IP address is, public or
private doesn't make a difference to the kernel.
I think it is time to do what should have been done in the first
place:
tcpdump -i eth0 -w debugfile -s 1500
If you can reproduce the problem with the above running we can see
what is actually happening.
If it is a very high traffic link you may want to add a filter to only
grab the interesting stuff...in fact I would do that anyway to make
reading the information back easier, just don't filter out ICMP
messages.
BTW, I know you posted your rule set at some point, but I don't
remember anything about it. Have you ruled that out?
-----BEGIN PGP SIGNATURE-----
Comment: Keeping the world safe for geeks.
iD8DBQE8H+ztwBVKl/Nci0oRAqXUAKDQC0xckF50n0jUK/uv8/7snjWMOACfeZdy
zmK4VYAN93/uC+vRVj8gzmE=
=wjKj
-----END PGP SIGNATURE-----
- Next message: Doubletwist: "Re: IPTables Problem: I think I figured it out... [was IPTables"
- Previous message: Tim Haynes: "Re: IPTables Problem: I think I figured it out... [was IPTables Established connection Problem]"
- In reply to: Tim Haynes: "Re: IPTables Problem: I think I figured it out... [was IPTables Established connection Problem]"
- Next in thread: Doubletwist: "Re: IPTables Problem: I think I figured it out... [was IPTables"
- Reply: Doubletwist: "Re: IPTables Problem: I think I figured it out... [was IPTables"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
