Very wierd problem

[Svenne Krap <svenne@krap.dk>]

[-- Attachment #1: Type: text/plain, Size: 2316 bytes --]

Hi.

I have quite a problem.

One of my customer is suddently unable to upload data to his machine 
(neither via SFTP/SCP nor regular FTP nor HTTP) behind my firewall. I 
believe it is due to something changed on the network he is connected to 
(as I have not changed anything during that period). He has no problems 
downloading data, but when uploading the upload stalls after 4kb of 
transfer.
What is even worse, I cannot recreate the problem from anywhere I have 
tried (>5 different ISP's).

The setup is like this:

In front of my network is a small (/29) network. The bigger (/26) 
"production" network is routed through one of the addresses on  the /29 
network (made by the upstream provider).
On this address, the firewall sits. My upstream is tripple-homed, I have 
no idea about the customers upstream.

I use iptables is version 1.3.4 (installed through Gentoo's portage) and 
a vanilla (not Gentoo enhanced) Linux 2.6.14.2.

The way it works, netfilter basicly rewrites the "known" public ip's 
from the /26 network to some private (192.168.x.y) addresses where X is 
a customer key and Y is the machine number for this customer.
The traffic is also filtered against machine specfic rules on what to 
allow initiating new connections from the outside (SSH, HTTP and so on) 
and connection tracking is taking care of the rest (ESTABLISHED/RELATED).
All this trafic leaves by one physical interface through multiple VLANS 
to a VLAN aware switch and to the final destination.

This has worked flawlessy for half a year or so. But suddently it stop 
working.
The customer's upstream provider blames my firewall. An interesting 
point is that the customer CAN upload to the firewall itself by scp 
through it's /29 adress (it has no /26).
But as said, I have not changed anything in the way the firewall works 
around when the problem arose, and any attempt to recreate it has been a 
failure.

I have tried to log packets both in the filter tables and the prerouting 
chain of the nat filter (before doing the nat). But nothing really 
catches my eyes.

Any suggestions to what could be the problem ? Or how I could zero in on 
it ? What to log and so on?

I am not really keen on publishing the firewall script, but I will send 
it to helpful individuals by email on request.

Thanks in advance

Svenne

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/x-pkcs7-signature, Size: 3254 bytes --]