All of lore.kernel.org
 help / color / mirror / Atom feed
* Very wierd problem
@ 2005-12-10 13:22 Svenne Krap
  0 siblings, 0 replies; 3+ messages in thread
From: Svenne Krap @ 2005-12-10 13:22 UTC (permalink / raw)
  To: netfilter

[-- Attachment #1: Type: text/plain, Size: 2316 bytes --]

Hi.

I have quite a problem.

One of my customer is suddently unable to upload data to his machine 
(neither via SFTP/SCP nor regular FTP nor HTTP) behind my firewall. I 
believe it is due to something changed on the network he is connected to 
(as I have not changed anything during that period). He has no problems 
downloading data, but when uploading the upload stalls after 4kb of 
transfer.
What is even worse, I cannot recreate the problem from anywhere I have 
tried (>5 different ISP's).

The setup is like this:

In front of my network is a small (/29) network. The bigger (/26) 
"production" network is routed through one of the addresses on  the /29 
network (made by the upstream provider).
On this address, the firewall sits. My upstream is tripple-homed, I have 
no idea about the customers upstream.

I use iptables is version 1.3.4 (installed through Gentoo's portage) and 
a vanilla (not Gentoo enhanced) Linux 2.6.14.2.

The way it works, netfilter basicly rewrites the "known" public ip's 
from the /26 network to some private (192.168.x.y) addresses where X is 
a customer key and Y is the machine number for this customer.
The traffic is also filtered against machine specfic rules on what to 
allow initiating new connections from the outside (SSH, HTTP and so on) 
and connection tracking is taking care of the rest (ESTABLISHED/RELATED).
All this trafic leaves by one physical interface through multiple VLANS 
to a VLAN aware switch and to the final destination.

This has worked flawlessy for half a year or so. But suddently it stop 
working.
The customer's upstream provider blames my firewall. An interesting 
point is that the customer CAN upload to the firewall itself by scp 
through it's /29 adress (it has no /26).
But as said, I have not changed anything in the way the firewall works 
around when the problem arose, and any attempt to recreate it has been a 
failure.

I have tried to log packets both in the filter tables and the prerouting 
chain of the nat filter (before doing the nat). But nothing really 
catches my eyes.

Any suggestions to what could be the problem ? Or how I could zero in on 
it ? What to log and so on?

I am not really keen on publishing the firewall script, but I will send 
it to helpful individuals by email on request.

Thanks in advance

Svenne

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/x-pkcs7-signature, Size: 3254 bytes --]

^ permalink raw reply	[flat|nested] 3+ messages in thread
* RE: Very wierd problem
@ 2005-12-12 15:28 Derick Anderson
  2005-12-12 19:20 ` Svenne Krap
  0 siblings, 1 reply; 3+ messages in thread
From: Derick Anderson @ 2005-12-12 15:28 UTC (permalink / raw)
  To: Svenne Krap, netfilter

Inline.

> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org 
> [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of 
> Svenne Krap
> Sent: Saturday, December 10, 2005 8:23 AM
> To: netfilter@lists.netfilter.org
> Subject: Very wierd problem
> 
> Hi.
> 
> I have quite a problem.
> 
> One of my customer is suddently unable to upload data to his 
> machine (neither via SFTP/SCP nor regular FTP nor HTTP) 
> behind my firewall. I believe it is due to something changed 
> on the network he is connected to (as I have not changed 
> anything during that period). He has no problems downloading 
> data, but when uploading the upload stalls after 4kb of transfer.
> What is even worse, I cannot recreate the problem from 
> anywhere I have tried (>5 different ISP's).

I interpret this to mean that the problem is with a particular customer
on a particular ISP - your other customers can upload just fine. The
fact that data can be downloaded (but not uploaded) is very strange.

[snip]

> This has worked flawlessy for half a year or so. But 
> suddently it stop working.
> The customer's upstream provider blames my firewall. An 
> interesting point is that the customer CAN upload to the 
> firewall itself by scp through it's /29 adress (it has no /26).
> But as said, I have not changed anything in the way the 
> firewall works around when the problem arose, and any attempt 
> to recreate it has been a failure.

Of course they blame your firewall. Did they give a reason? I assume
when you attempt to recreate the problem you are uploading to the
customer's server on your network and it works fine, and that your other
customers are not having problems with similar rulesets.

If you haven't changed anything, I would recommend not messing with your
firewall. My first urge when there is a problem is to check everything
and start changing things which "don't look right". However if there is
a system which is the same now as it was when things were working then I
stifle that urge and look elsewhere. Maybe there's something with the
client's internal server or settings on the VLAN switch... Verify your
settings but don't go changing them without a good reason. If you do
find something odd change one thing at a time and then test - otherwise
you'll never know exactly what the problem was.

> I have tried to log packets both in the filter tables and the 
> prerouting chain of the nat filter (before doing the nat). 
> But nothing really catches my eyes.
> 
> Any suggestions to what could be the problem ? Or how I could 
> zero in on it ? What to log and so on?
> 
> I am not really keen on publishing the firewall script, but I 
> will send it to helpful individuals by email on request.
> 
> Thanks in advance
> 
> Svenne
> 

I would set up ethereal on your firewall and monitor both sides of a
transfer from this client. See who sends the last packet before the
connection is dropped. Since this problem appears to be protocol
independent, I would pay close attention to the TCP connections, but I
would also be curious about HTTP and FTP since they are cleartext and
may have some additional information about what might be going on
(timeouts, etc.).

Derick Anderson


^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2005-12-12 19:20 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2005-12-10 13:22 Very wierd problem Svenne Krap
  -- strict thread matches above, loose matches on Subject: below --
2005-12-12 15:28 Derick Anderson
2005-12-12 19:20 ` Svenne Krap

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.