Can't access select websites

Can't access select websites

[Chris Miller]

I've got a WRT54GL with three interfaces. The router connects via PPPoE 
(ppp0) and has a public routed /29 to one interface (br0), and a private 
/24 with NAT on another interface (vlan2). The rules are not 
particularly fancy and access from/to the internal networks is fine. I 
can access any website from either LAN just fine, except I can't access 
microsoft.com and fscrater.com. Both these sites have one thing in 
common, they filter ping. Tcpdump from a *nix box on the public LAN 
shows that the initial http connection is being acknowledged by the 
remote web server, but subsequent incoming packets seem to be dropped. 
I've enabled logging in my FW script and remote syslog on the router, 
but logging seems to go into the bit bucket. I suspect that may be due 
to the way iptables is compiled for the WRT. 
 
I have an identical setup in another location that does not experience 
this problem, the difference is the /29 is routed via a /30 on the WAN 
side, PPPoE is not used. AT&T appears to be preserving IP space by using 
PPPoE and an internal 192.x.x.x address on the DSLAM. So PPPoE seems to 
be related to the problem. 
 
I've verified that NAT is not happening on the public interface, so it's 
not a NAT issue. Without the ability to see what's happening via 
logging, I'm lost. Has anyone seen this behavior before? Any suggestions 
on where logging might be going?

Chris

Re: Can't access select websites

[Andy Furniss]

Chris Miller wrote:
> 
> I've got a WRT54GL with three interfaces. The router connects via PPPoE 
> (ppp0) and has a public routed /29 to one interface (br0), and a private 
> /24 with NAT on another interface (vlan2). The rules are not 
> particularly fancy and access from/to the internal networks is fine. I 
> can access any website from either LAN just fine, except I can't access 
> microsoft.com and fscrater.com. Both these sites have one thing in 
> common, they filter ping. Tcpdump from a *nix box on the public LAN 
> shows that the initial http connection is being acknowledged by the 
> remote web server, but subsequent incoming packets seem to be dropped. 
> I've enabled logging in my FW script and remote syslog on the router, 
> but logging seems to go into the bit bucket. I suspect that may be due 
> to the way iptables is compiled for the WRT.
> I have an identical setup in another location that does not experience 
> this problem, the difference is the /29 is routed via a /30 on the WAN 
> side, PPPoE is not used. AT&T appears to be preserving IP space by using 
> PPPoE and an internal 192.x.x.x address on the DSLAM. So PPPoE seems to 
> be related to the problem.
> I've verified that NAT is not happening on the public interface, so it's 
> not a NAT issue. Without the ability to see what's happening via 
> logging, I'm lost. Has anyone seen this behavior before? Any suggestions 
> on where logging might be going?

Don't know about the logging.

If you have to use pppoe then either set LAN PC MTUs to 1492 or maybe 
mss clamp on the router (if you can).

Andy.