Re: Is iptables black-listing me?

[Alistair Tonner <Alistair@nerdnet.ca>]

On July 9, 2004 11:23 am, Olivier.Keunen@crp-sante.healthnet.lu wrote:
> Hello,
>
> Here is the problem I hope somebody on the list can help me with:
>
> We have been running iptables on a Debian Linux box for some times. It
> works fine, except that from time to time, one of the server in the farm
> is denied access through the firewall for a while without any evidenced of
> what is causing the default nor what fixes it ! Traffic through the
> firewall from other servers in the farm still flows normally in the
> meantime. The box is somewhat loaded as it runs a Windows 2000 DC, DNS,
> DHCP & mail services, but it seems to work fine for what I can tell.
>
> We have both nating & filtering rules as follow (where x.x. & y.y. replace
> the external & internal network IP ranges):
>
> # Generated by iptables-save v1.2.6a on Thu Jan 22 14:47:03 2004
> *mangle

	Greetings Oliver:

	1) please don't use iptables-save output -- it isn't easy to read, and is 
often unclear on certain details ..  Most here prefer (from what I've seen) 
to see the output from 
iptables -L -n -v -x 
	and 
iptables -L -n -v -x -t [ nat/mangle ] 
   for analysis -- or the script that actually loads the rules.. 

	2) Same box every time? Same problem every time? 
	*takes a quick glance at the rules*  -- have you completely eliminated 
	all components on the windows box and what I presume is a switch that
	sits between linux / windows? -- this sounds like a GigE card problem 
	we were having on win2k boxen running as DC's ...  they were plugged into 
	100Mb Ethernet ports on a cisco .. and apparently the cards would try to step
	up to 1000Mb once in a while ---  hard setting the speed fixed the problem.
	AutosenseLESS is my motto...

	3) I would strongly reccommend that the next instance of this problem you 
	insert LOG rules at the top of FORWARD and INPUT for the source IP and 
	see if you are actually getting the packets, and possibly see why your 
	rules might be dropping them.
	LOGged packets will go to your default syslog -- whereever that might be 
	on Deb.

>	Could it be related to the [232015:19489204] -A INPUT -p icmp -m icmp 
>	--icmp-type 8 -m limit --limit 6/sec -j ACCEPT  rule that was set to avoid 
>	"ping of death" attacks

	I highgly doubt it unless all the communication you are referring to is ICMP.
	This rule is limited to ICMP and should not drop TCP or UDP.  You might 
	not be able to ping out for a while, but the rule is fairly relaxed .. 
	someone once posted an excellent explaination of the timing buckets for this, 
	but it is slightly beyond my recall at the moment.

	Alistair Tonner

> Thanks in advance to whoever can help...
>
> Olivier.