* MASQUERADE: Route sent us somewhere else. @ 2005-04-03 13:39 Tim Evans 2005-04-04 2:11 ` IPTables & HTTPD Conflict J A 0 siblings, 1 reply; 6+ messages in thread From: Tim Evans @ 2005-04-03 13:39 UTC (permalink / raw) To: netfilter Since upgrading to RedHat Enterprise Version 4, I've been having goofy routing problems and iptables has been logging this message regularly: Apr 3 04:15:01 kestrel kernel: MASQUERADE: Route sent us somewhere else. My immediate ISP is Comcast, but my main domain is hosted at another ISP. By "goofy routing problems," I mean I have trouble accessing my *own domain* at my ISP for POP-ing down e-mail and *all* other connections. There are periods of anywhere from a few minutes to an hour or longer where all connections to the domain simply time out. At the same time, I *can* connect to other domains, including others that belong to me on the same ISP. During these incidents, traceroutes to my main domain hang at the very first hop (Comcast's first router); if I run a traceroute to any other site in a different window at the very same time, it proceeds all the way to its destination virtually instantly. The above error consistently corresponds with a cron job that runs fetchmail to POP my e-mail down from the ISP. I have the following lines in my iptables script that reference masquerading: /sbin/modprobe ipt_MASQUERADE /sbin/iptables -t nat -A POSTROUTING -o $INET_IFACE -j MASQUERADE I have not changed the iptables script since upgrading to RHEL 4; I did not see any such problems with RHEL 3. What's doubly goofy about these problems is they're intermittent. After a spell of being unable to connect (again, ranging from just a few minutes to an hour or more), it'll suddenly begin working. And, to repeat, this only affects my primary domain; no other connections to any other domain I try see these failures. -- Tim Evans, TKEvans.com, Inc. | 5 Chestnut Court tkevans@tkevans.com | Owings Mills, MD 21117 http://www.tkevans.com/ | 443-394-3864 http://www.come-here.com/News/ | ^ permalink raw reply [flat|nested] 6+ messages in thread
* IPTables & HTTPD Conflict 2005-04-03 13:39 MASQUERADE: Route sent us somewhere else Tim Evans @ 2005-04-04 2:11 ` J A 2005-04-04 9:40 ` Askar 0 siblings, 1 reply; 6+ messages in thread From: J A @ 2005-04-04 2:11 UTC (permalink / raw) To: netfilter Hello All, We're using Redhat 9 We've been running a Web Server (Apache & Tomcat), and were told to run a firewall, in this case IPTables. When we enabled IPTables, many of our web sites (BUT not all) could no longer be browsed from the Internet. Could you tell us which specific IPTables parameter is doing this, so we could disable only the specific parameter? Or is it not advisable to run IPTables side-by-side with Web services? Thanks, appreciate your ideas. ---jake ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: IPTables & HTTPD Conflict 2005-04-04 2:11 ` IPTables & HTTPD Conflict J A @ 2005-04-04 9:40 ` Askar 2005-04-04 9:59 ` J A 0 siblings, 1 reply; 6+ messages in thread From: Askar @ 2005-04-04 9:40 UTC (permalink / raw) To: J A; +Cc: netfilter how should we suggest something without watchen your iptables rules set? regards On Apr 4, 2005 8:11 AM, J A <jake.lists@gmail.com> wrote: > Hello All, > > We're using Redhat 9 > We've been running a Web Server (Apache & Tomcat), and were told to > run a firewall, in this case IPTables. When we enabled IPTables, many > of our web sites (BUT not all) could no longer be browsed from the > Internet. > > Could you tell us which specific IPTables parameter is doing this, so > we could disable only the specific parameter? > Or is it not advisable to run IPTables side-by-side with Web services? > > Thanks, appreciate your ideas. > > ---jake > > -- I love deadlines. I like the whooshing sound they make as they fly by. Douglas Adams ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: IPTables & HTTPD Conflict 2005-04-04 9:40 ` Askar @ 2005-04-04 9:59 ` J A 2005-04-04 11:32 ` Askar 0 siblings, 1 reply; 6+ messages in thread From: J A @ 2005-04-04 9:59 UTC (permalink / raw) To: Askar; +Cc: netfilter Sorry, when i replied to the thread, i seemed to have copied only guido, here's a re-send: Here are our rules (pls refer to the thread for the problem description), hope you could share us your vasluable insight. -------------------------------------------------------------------------- *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :RH-Lokkit-0-50-INPUT - [0:0] -A INPUT -j RH-Lokkit-0-50-INPUT -A FORWARD -j RH-Lokkit-0-50-INPUT -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 25 --syn -j ACCEPT -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 80 --syn -j ACCEPT -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 21 --syn -j ACCEPT -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 22 --syn -j ACCEPT -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 23 --syn -j ACCEPT -A RH-Lokkit-0-50-INPUT -i lo -j ACCEPT -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 0:1023 --syn -j REJECT -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2049 --syn -j REJECT -A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 0:1023 -j REJECT -A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 2049 -j REJECT -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 6000:6009 --syn -j REJECT -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 7100 --syn -j REJECT COMMIT -------------------------------------------------------------------------- On Apr 4, 2005 5:40 PM, Askar <askarali@gmail.com> wrote: > how should we suggest something without watchen your iptables rules set? > > regards > > > On Apr 4, 2005 8:11 AM, J A <jake.lists@gmail.com> wrote: > > Hello All, > > > > We're using Redhat 9 > > We've been running a Web Server (Apache & Tomcat), and were told to > > run a firewall, in this case IPTables. When we enabled IPTables, many > > of our web sites (BUT not all) could no longer be browsed from the > > Internet. > > > > Could you tell us which specific IPTables parameter is doing this, so > > we could disable only the specific parameter? > > Or is it not advisable to run IPTables side-by-side with Web services? > > > > Thanks, appreciate your ideas. > > > > ---jake > > > > > > -- > I love deadlines. I like the whooshing sound they make as they fly by. > Douglas Adams > ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: IPTables & HTTPD Conflict 2005-04-04 9:59 ` J A @ 2005-04-04 11:32 ` Askar 2005-04-05 6:41 ` J A 0 siblings, 1 reply; 6+ messages in thread From: Askar @ 2005-04-04 11:32 UTC (permalink / raw) To: J A; +Cc: netfilter On Apr 4, 2005 3:59 PM, J A <jake.lists@gmail.com> wrote: > Sorry, when i replied to the thread, i seemed to have copied only > guido, here's a re-send: > > Here are our rules (pls refer to the thread for the problem > description), hope you could share us your vasluable insight. > -------------------------------------------------------------------------- > *filter > :INPUT ACCEPT [0:0] > :FORWARD ACCEPT [0:0] > :OUTPUT ACCEPT [0:0] > :RH-Lokkit-0-50-INPUT - [0:0] > -A INPUT -j RH-Lokkit-0-50-INPUT > -A FORWARD -j RH-Lokkit-0-50-INPUT > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 25 --syn -j ACCEPT > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 80 --syn -j ACCEPT > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 21 --syn -j ACCEPT > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 22 --syn -j ACCEPT > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 23 --syn -j ACCEPT > -A RH-Lokkit-0-50-INPUT -i lo -j ACCEPT > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 0:1023 --syn -j REJECT > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2049 --syn -j REJECT > -A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 0:1023 -j REJECT > -A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 2049 -j REJECT > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 6000:6009 --syn -j REJECT > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 7100 --syn -j REJECT > COMMIT > -------------------------------------------------------------------------- > > > On Apr 4, 2005 5:40 PM, Askar <askarali@gmail.com> wrote: > > how should we suggest something without watchen your iptables rules set? > > > > regards > > > > > > On Apr 4, 2005 8:11 AM, J A <jake.lists@gmail.com> wrote: > > > Hello All, > > > > > > We're using Redhat 9 > > > We've been running a Web Server (Apache & Tomcat), and were told to > > > run a firewall, in this case IPTables. When we enabled IPTables, many > > > of our web sites (BUT not all) could no longer be browsed from the > > > Internet. > > > > > > Could you tell us which specific IPTables parameter is doing this, so > > > we could disable only the specific parameter? > > > Or is it not advisable to run IPTables side-by-side with Web services? > > > > > > Thanks, appreciate your ideas. > > > > > > ---jake > > > > > > > > > > -- > > I love deadlines. I like the whooshing sound they make as they fly by. > > Douglas Adams > > > okay try these iptables rules as starting point, # Load the FTP connection state helper module. #Clear \ Flush all the rules from the different chains and tables for table in mangle nat filter; do iptables -t $table -F iptables -t $table -X done # Set the default filter table policy iptables --policy INPUT DROP iptables --policy OUTPUT ACCEPT iptables --policy FORWARD DROP # Using Connection State to By-pass Rule Checking iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -p tcp -m multiport --dport 25,80,21,22,23 -m state --state NEW -j ACCEPT Note: save these rules to a file, then chmod +x the file and then execute it with ./filename :) regards -- I love deadlines. I like the whooshing sound they make as they fly by. Douglas Adams ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: IPTables & HTTPD Conflict 2005-04-04 11:32 ` Askar @ 2005-04-05 6:41 ` J A 0 siblings, 0 replies; 6+ messages in thread From: J A @ 2005-04-05 6:41 UTC (permalink / raw) To: Askar; +Cc: netfilter Hello Askar/A.Dreyer, Thank you very much for your insights, now i see how badly our IPTables is setup. Will re-configure along your recommended settings, and see how system goes. I will post whatever our final rules will look like. Best regards! ---jake On Apr 4, 2005 7:32 PM, Askar <askarali@gmail.com> wrote: > On Apr 4, 2005 3:59 PM, J A <jake.lists@gmail.com> wrote: > > Sorry, when i replied to the thread, i seemed to have copied only > > guido, here's a re-send: > > > > Here are our rules (pls refer to the thread for the problem > > description), hope you could share us your vasluable insight. > > -------------------------------------------------------------------------- > > *filter > > :INPUT ACCEPT [0:0] > > :FORWARD ACCEPT [0:0] > > :OUTPUT ACCEPT [0:0] > > :RH-Lokkit-0-50-INPUT - [0:0] > > -A INPUT -j RH-Lokkit-0-50-INPUT > > -A FORWARD -j RH-Lokkit-0-50-INPUT > > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 25 --syn -j ACCEPT > > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 80 --syn -j ACCEPT > > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 21 --syn -j ACCEPT > > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 22 --syn -j ACCEPT > > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 23 --syn -j ACCEPT > > -A RH-Lokkit-0-50-INPUT -i lo -j ACCEPT > > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 0:1023 --syn -j REJECT > > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2049 --syn -j REJECT > > -A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 0:1023 -j REJECT > > -A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 2049 -j REJECT > > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 6000:6009 --syn -j REJECT > > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 7100 --syn -j REJECT > > COMMIT > > -------------------------------------------------------------------------- > > > > > > On Apr 4, 2005 5:40 PM, Askar <askarali@gmail.com> wrote: > > > how should we suggest something without watchen your iptables rules set? > > > > > > regards > > > > > > > > > On Apr 4, 2005 8:11 AM, J A <jake.lists@gmail.com> wrote: > > > > Hello All, > > > > > > > > We're using Redhat 9 > > > > We've been running a Web Server (Apache & Tomcat), and were told to > > > > run a firewall, in this case IPTables. When we enabled IPTables, many > > > > of our web sites (BUT not all) could no longer be browsed from the > > > > Internet. > > > > > > > > Could you tell us which specific IPTables parameter is doing this, so > > > > we could disable only the specific parameter? > > > > Or is it not advisable to run IPTables side-by-side with Web services? > > > > > > > > Thanks, appreciate your ideas. > > > > > > > > ---jake > > > > > > > > > > > > > > -- > > > I love deadlines. I like the whooshing sound they make as they fly by. > > > Douglas Adams > > > > > > okay try these iptables rules as starting point, > > # Load the FTP connection state helper module. > #Clear \ Flush all the rules from the different chains and tables > for table in mangle nat filter; do > iptables -t $table -F > iptables -t $table -X > done > # Set the default filter table policy > iptables --policy INPUT DROP > iptables --policy OUTPUT ACCEPT > iptables --policy FORWARD DROP > > # Using Connection State to By-pass Rule Checking > iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT > iptables -A INPUT -p tcp -m multiport --dport 25,80,21,22,23 -m state > --state NEW -j ACCEPT > > Note: save these rules to a file, then chmod +x the file and then > execute it with ./filename :) > > regards > > > -- > I love deadlines. I like the whooshing sound they make as they fly by. > Douglas Adams > ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2005-04-05 6:41 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2005-04-03 13:39 MASQUERADE: Route sent us somewhere else Tim Evans 2005-04-04 2:11 ` IPTables & HTTPD Conflict J A 2005-04-04 9:40 ` Askar 2005-04-04 9:59 ` J A 2005-04-04 11:32 ` Askar 2005-04-05 6:41 ` J A
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.