Re: Strange problem with iptables IP Masq

[Cedric Blancher <blancher@cartel-securite.fr>]

Le lun 16/09/2002 à 23:02, Lior Hammer a écrit :
> I'm using the IP Masq script from the IP masq howto from TLDP.
> The connection sharing is fine except for one thing:
> in some of the sites (for example: http://httpd.apache.org or DynDNS.org
> members area) my browser keep's searching and searching without any result
> (or other response) or it just print few lines and that's it.
> I thought it's a problem with my browser, so i tryed to get the page
> directly with telnet.
> i got the HTTP Headers, and the first lines, and that's it, it didn't
> disconnect or somthing, just waited.
> Everything is ok when i'm trying to get this page directrly with lynx from
> the computer that shares the conection.

Are you connected via ADSL line using PPPoE ?

If so, you have to lower TCP MSS for forwarded packets down to 1452 (MTU
1492) to avoid problems when PMTU discovery is broken. This can be done
directly on pppoed using -m switch :

	pppoe -I eth0 -T 80 -m 1452

Or this can be done using Netfilter mangle table :

	iptables -t mangle -A FORWARD -o ppp0 -p tcp --syn \
		-j TCPMSS --clamp-mss-to-pmtu

If not, forwarded hosts will export a 1460 TCP MSS (MTU 1500). Big
replies will be to big and lost.

-- 
Cédric Blancher
Consultant en sécurité des systèmes et réseaux  - Cartel Sécurité
Tél: +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE