iprange

iprange

[Vigil]

Hi, I have just installed iptables 1.2.9 from source, but it seems that the
iprange module that is now built in, is not working. From the iprange pom
documentation, it used to be that '-m iprange --dst-range
10.0.0.0-10.5.255.255.255' would work. Now, that is not working. It gives the
error, "iptables: No chain/target/match by that name", and iptables isn't
recognising -m as an argument anyway, but perhaps the -m argument is added by
pom, which I'm not using now. I figured I don't need to '-m iprange', since it
is built in, but without that, iptables doesn't recognise --dst-range. I thought
maybe I don't need to tell it that it's a range any more, that it will recognise
it as a range, and so with just '-d 10.0.0.0-10.5.255.255.255', iptables
complains that the host/network is not found.

Is iprange even being built in, as the changelog suggests? Do I have to activate
it in some way? Or has the iprange usage changed? How do I get it working as
before?

Thanks.

-- 

.

Re: iprange

[Alistair Tonner]

On November 7, 2003 11:45 am, Vigil wrote:
> Hi, I have just installed iptables 1.2.9 from source, but it seems that the
> iprange module that is now built in, is not working. From the iprange pom
> documentation, it used to be that '-m iprange --dst-range
> 10.0.0.0-10.5.255.255.255' would work. Now, that is not working. It gives
> the error, "iptables: No chain/target/match by that name", and iptables
> isn't recognising -m as an argument anyway, but perhaps the -m argument is
> added by pom, which I'm not using now. I figured I don't need to '-m
> iprange', since it is built in, but without that, iptables doesn't
> recognise --dst-range. I thought maybe I don't need to tell it that it's a
> range any more, that it will recognise it as a range, and so with just '-d
> 10.0.0.0-10.5.255.255.255', iptables complains that the host/network is not
> found.
>
> Is iprange even being built in, as the changelog suggests? Do I have to
> activate it in some way? Or has the iprange usage changed? How do I get it
> working as before?
>
> Thanks.

	how many copies of iptables are there on your system? which one is being 
used, what versions are they?

-- 

	Alistair Tonner
	nerdnet.ca
	Senior Systems Analyst - RSS
	
     Any sufficiently advanced technology will have the appearance of magic.
	Lets get magical!

Re: iprange

[Vigil]

1.2.8 (from Slackware 9, without pom and iprange) was installed when I compiled
1.2.9. I uninstalled it before installing 1.2.9. I then uninstalled 1.2.9,
unpacked it and compiled and installed it again, just in case anything from
1.2.8 was interfering. I then recompiled the kernel (2.4.22) and rebooted with
the new 1.2.9, then uninstalled it and compiled and installed it again(!)

On Fri, 7 Nov 2003, Alistair Tonner Alistair-at-nerdnet.ca |Netfilter Mailing List| wrote:

>	how many copies of iptables are there on your system? which one is being
>used, what versions are they?

-- 

.

Re: iprange

[Vigil]

I take it nobody else uses iprange or any other new built plugins (connlimit,
realm, classify, connmark, netmap) with 1.2.9?

On Fri, 7 Nov 2003, Vigil nvnwdfuq02-at-sneakemail.com |Netfilter Mailing List| wrote:

>1.2.8 (from Slackware 9, without pom and iprange) was installed when I compiled
>1.2.9. I uninstalled it before installing 1.2.9. I then uninstalled 1.2.9,
>unpacked it and compiled and installed it again, just in case anything from
>1.2.8 was interfering. I then recompiled the kernel (2.4.22) and rebooted with
>the new 1.2.9, then uninstalled it and compiled and installed it again(!)
>
>On Fri, 7 Nov 2003, Alistair Tonner Alistair-at-nerdnet.ca |Netfilter Mailing List| wrote:
>
>>	how many copies of iptables are there on your system? which one is being
>>used, what versions are they?
>
>

-- 

.

Re: iprange

[Jozsef Kadlecsik]

On Mon, 10 Nov 2003, Vigil wrote:

> I take it nobody else uses iprange or any other new built plugins (connlimit,
> realm, classify, connmark, netmap) with 1.2.9?

I have just checked and it works fine (2.4.22 kernel + 1.2.9 iptables
release).

> On Fri, 7 Nov 2003, Vigil nvnwdfuq02-at-sneakemail.com |Netfilter Mailing List| wrote:
>
> >1.2.8 (from Slackware 9, without pom and iprange) was installed when I compiled
> >1.2.9. I uninstalled it before installing 1.2.9. I then uninstalled 1.2.9,
> >unpacked it and compiled and installed it again, just in case anything from
> >1.2.8 was interfering. I then recompiled the kernel (2.4.22) and rebooted with
> >the new 1.2.9, then uninstalled it and compiled and installed it again(!)

I still suspect you have got two iptables binaries on your system and you
start the previous one instead what you installed from source.

iptables installed from source goes into /usr/local/sbin/iptables. Call
the binary with full path to be sure.

Please don't try to guess the syntax: it works as it is documented in the
manpage: iprange is an extension, so you must invoke it as
'iptables .... -m iprange <iprange-options>' ...

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@sunserv.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: iprange

[Vigil]

Oh, ngh. Excuse me, I read it being built into iptables as I wouldn't have to
build it into the kernel. As I say, ngh.

On Tue, 11 Nov 2003, Jozsef Kadlecsik kadlec-at-blackhole.kfki.hu |Netfilter Mailing List| wrote:

>I still suspect you have got two iptables binaries on your system and you start
>the previous one instead what you installed from source.

-- 

.

Re: iprange

[Alistair Tonner]

On November 11, 2003 11:01 am, Vigil wrote:
> Oh, ngh. Excuse me, I read it being built into iptables as I wouldn't have
> to build it into the kernel. As I say, ngh.
>
> On Tue, 11 Nov 2003, Jozsef Kadlecsik kadlec-at-blackhole.kfki.hu |Netfilter 
Mailing List| wrote:
> >I still suspect you have got two iptables binaries on your system and you
> > start the previous one instead what you installed from source.


	Vigil the problem likely is that you have an OLD rpm installation at /usr/
 	and the new built iptables at /usr/local/ 

	This usually causes the sort of problem you are experiencing......
	
	try :
	
	find /usr -name iptables

	if you get more than one result you have this problem.... 
-- 

	Alistair Tonner
	nerdnet.ca
	Senior Systems Analyst - RSS
	
     Any sufficiently advanced technology will have the appearance of magic.
	Lets get magical!

Re: iprange

[Jozsef Kadlecsik]

On Tue, 11 Nov 2003, Vigil wrote:

> Oh, ngh. Excuse me, I read it being built into iptables as I wouldn't have to
> build it into the kernel. As I say, ngh.

What is 'ngh'? Negative?

Where did you read it's built into the iptables *binary*? Which binary?
Why are you sure it's truly built into the binary on your machine?

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@sunserv.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: iprange

[Vigil]

>What is 'ngh'? Negative?

It is the sound a mong makes when he realises he made a stupid mistake.

>Where did you read it's built into the iptables *binary*? Which binary? Why are
>you sure it's truly built into the binary on your machine?

All I did to resolve my problem was run the iprange patch from patch-o-matic to
put it into my kernel, recompile the kernel and reboot. Patch-o-matic didn't
touch iptables 1.2.9 that I already had installed.

IIRC (and I probably don't), I had to compile patch-o-matic's netfilter with the
iprange patch and use that instead of the 'normal' iptables 1.2.8 source. I just
forgot that there were two parts to getting iprange working: 1. iptables has to
recognise it, 2. the kernel also must be compiled with it. With the 1.2.9
changelog saying iprange was built into it, in my excitement I forgot about part
two.

-- 

.

Forwarding GnomeMeeting to internal network

[Julien Didron]

Hello list,

I wish to use GnomeMeeting, for which I assume the only port that needs 
opening is 1720.
Now, how can I forward all incoming traffic to port 1720 on the router, to 
one machine on the network that doesn't have a fixed IP (DHCP), but has name 
on the domain thanks to DDNS (ex : abox.mydomain.net).

Another question regarding ip_conntrack. After 5 days of use, I get the 
following error in syslog : "ip_conntrack table full, dropping packet.". I 
then increased the value in /proc/sys/net/ipv4/ip_conntrack_max, from 3048 to 
8192, but I think this is a quick fix that won't get me too far ... Is there 
a mean of flushing that table ? If not, how can I lower the TCP connection 
timeouts ?

Thanks in advance.

--
Open WebMail Project (http://openwebmail.org)

Re: Forwarding GnomeMeeting to internal network

[Antony Stone]

On Wednesday 12 November 2003 10:35 am, Julien Didron wrote:

> Hello list,
>
> I wish to use GnomeMeeting, for which I assume the only port that needs
> opening is 1720.
> Now, how can I forward all incoming traffic to port 1720 on the router, to
> one machine on the network that doesn't have a fixed IP (DHCP), but has
> name on the domain thanks to DDNS (ex : abox.mydomain.net).

netfilter can only redirect packets to known IP addresses.

> Another question regarding ip_conntrack. After 5 days of use, I get the
> following error in syslog : "ip_conntrack table full, dropping packet.". I
> then increased the value in /proc/sys/net/ipv4/ip_conntrack_max, from 3048
> to 8192, but I think this is a quick fix that won't get me too far ...

Several thousand active connections is a *lot*.   Unless you have a very 
large network (maybe you do?), this would suggest something sinister, such as 
a worm-infected machine attempting to connect to other machines out on the 
Internet and leaving lots of half-open connections in the conntrack table.

Look at the entries in the conntrack table and identify what the problem is 
instead of simply making the table larger and allowing the problem to get 
bigger.

> Is there a mean of flushing that table ? If not, how can I lower the TCP
> connection timeouts ?

Again, not really the right solution.   Find out what machine/s is/are 
filling upyour conntrack tableand fix them so that they don't.   A healthy 
network in normal operation doesn't fill up a conntrack table.

Antony.

-- 

When do you expect the official release of the 2.6.0 kernel?

Rusty Russell: From previous releases, a pattern has emerged: exactly 6 
months before it's ready.
                                                     Please reply to the list;
                                                           please don't CC me.

Re: Forwarding GnomeMeeting to internal network

[Jozsef Kadlecsik]

On Wed, 12 Nov 2003, Julien Didron wrote:

> I wish to use GnomeMeeting, for which I assume the only port that needs
> opening is 1720.

False. gnomemeeting uses H.323, which requires quite a lot of dynamic
ports besides TCP port 1720. Unfortunately the current H.323 helper in
patch-o-matic isn't compatible with GnomeMeeting, so the only way to go is
to install a H.323 (gatekeeper/)proxy.

> Now, how can I forward all incoming traffic to port 1720 on the router, to
> one machine on the network that doesn't have a fixed IP (DHCP), but has name
> on the domain thanks to DDNS (ex : abox.mydomain.net).

No way.

> Another question regarding ip_conntrack. After 5 days of use, I get the
> following error in syslog : "ip_conntrack table full, dropping packet.". I
> then increased the value in /proc/sys/net/ipv4/ip_conntrack_max, from 3048 to
> 8192, but I think this is a quick fix that won't get me too far ... Is there
> a mean of flushing that table ? If not, how can I lower the TCP connection
> timeouts ?

Remove the ip_conntrack module and all entries will be flushed. :-)

If you have to keep track many connections it's better to tune the
maximal number by setting a proper hashsize parameter when loading in
the ip_conntrack module.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@sunserv.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: Forwarding GnomeMeeting to internal network

[Julien Didron]

Hi again,


Thanks for the answer Antony.
I'll then grant this box a fixed IP using DHCP declaration with the MAC 
adress.

Concerning the ip_conntrack table, I indeed have a sort of worm on my network 
called "MLdonkey" ;o) (it's on some other box on the network), process that I 
kill everytime the problem occurs, but with no success : i still get the very 
same error line in syslog.
after increasing the value of ip_conntrack_max, I monitored the traffic on 
the outgoing interface, that was very little : say from 150B/s to 500B/s up 
and down.
For information my local network (this is home) is composed of 4 machines 
ranging from mail server (smtp and pop) to DDNS, DHCP and web server ... But 
I really don't think it to be a "large" network :o)

Again, thanks for the informations.

--
Open WebMail Project (http://openwebmail.org)


---------- Original Message -----------
From: Antony Stone <Antony@Soft-Solutions.co.uk>
To: Netfilter Mailing List <netfilter@lists.netfilter.org>
Sent: Wed, 12 Nov 2003 10:43:28 +0000
Subject: Re: Forwarding GnomeMeeting to internal network

> On Wednesday 12 November 2003 10:35 am, Julien Didron wrote:
> 
> > Hello list,
> >
> > I wish to use GnomeMeeting, for which I assume the only port that needs
> > opening is 1720.
> > Now, how can I forward all incoming traffic to port 1720 on the router, to
> > one machine on the network that doesn't have a fixed IP (DHCP), but has
> > name on the domain thanks to DDNS (ex : abox.mydomain.net).
> 
> netfilter can only redirect packets to known IP addresses.
> 
> > Another question regarding ip_conntrack. After 5 days of use, I get the
> > following error in syslog : "ip_conntrack table full, dropping packet.". I
> > then increased the value in /proc/sys/net/ipv4/ip_conntrack_max, from 3048
> > to 8192, but I think this is a quick fix that won't get me too far ...
> 
> Several thousand active connections is a *lot*.   Unless you have a very
> large network (maybe you do?), this would suggest something sinister,
>  such as a worm-infected machine attempting to connect to other 
> machines out on the Internet and leaving lots of half-open 
> connections in the conntrack table.
> 
> Look at the entries in the conntrack table and identify what the 
> problem is instead of simply making the table larger and allowing 
> the problem to get bigger.
> 
> > Is there a mean of flushing that table ? If not, how can I lower the TCP
> > connection timeouts ?
> 
> Again, not really the right solution.   Find out what machine/s 
> is/are filling upyour conntrack tableand fix them so that they 
> don't.   A healthy network in normal operation doesn't fill up a 
> conntrack table.
> 
> Antony.
> 
> --
> 
> When do you expect the official release of the 2.6.0 kernel?
> 
> Rusty Russell: From previous releases, a pattern has emerged: 
> exactly 6 months before it's ready.                                  
>                    Please reply to the list;                         
>                                   please don't CC me.
------- End of Original Message -------

RE: Forwarding GnomeMeeting to internal network

[Knight, Steve]

Fyi - MLdonkey is a windows & unix peer-to-peer client application [see
mldonkey.org]

-----Original Message-----
From: Julien Didron [mailto:admin@tripnotik.dyndns.org] 
Sent: 12 November 2003 1.11
To: Netfilter Mailing List
Subject: Re: Forwarding GnomeMeeting to internal network


Hi again,


Thanks for the answer Antony.
I'll then grant this box a fixed IP using DHCP declaration with the MAC 
adress.

Concerning the ip_conntrack table, I indeed have a sort of worm on my
network 
called "MLdonkey" ;o) (it's on some other box on the network), process that
I 
kill everytime the problem occurs, but with no success : i still get the
very 
same error line in syslog.
after increasing the value of ip_conntrack_max, I monitored the traffic on 
the outgoing interface, that was very little : say from 150B/s to 500B/s up 
and down.
For information my local network (this is home) is composed of 4 machines 
ranging from mail server (smtp and pop) to DDNS, DHCP and web server ... But

I really don't think it to be a "large" network :o)

Again, thanks for the informations.

--
Open WebMail Project (http://openwebmail.org)


---------- Original Message -----------
From: Antony Stone <Antony@Soft-Solutions.co.uk>
To: Netfilter Mailing List <netfilter@lists.netfilter.org>
Sent: Wed, 12 Nov 2003 10:43:28 +0000
Subject: Re: Forwarding GnomeMeeting to internal network

> On Wednesday 12 November 2003 10:35 am, Julien Didron wrote:
> 
> > Hello list,
> >
> > I wish to use GnomeMeeting, for which I assume the only port that needs
> > opening is 1720.
> > Now, how can I forward all incoming traffic to port 1720 on the router,
to
> > one machine on the network that doesn't have a fixed IP (DHCP), but has
> > name on the domain thanks to DDNS (ex : abox.mydomain.net).
> 
> netfilter can only redirect packets to known IP addresses.
> 
> > Another question regarding ip_conntrack. After 5 days of use, I get the
> > following error in syslog : "ip_conntrack table full, dropping packet.".
I
> > then increased the value in /proc/sys/net/ipv4/ip_conntrack_max, from
3048
> > to 8192, but I think this is a quick fix that won't get me too far ...
> 
> Several thousand active connections is a *lot*.   Unless you have a very
> large network (maybe you do?), this would suggest something sinister,
>  such as a worm-infected machine attempting to connect to other 
> machines out on the Internet and leaving lots of half-open 
> connections in the conntrack table.
> 
> Look at the entries in the conntrack table and identify what the 
> problem is instead of simply making the table larger and allowing 
> the problem to get bigger.
> 
> > Is there a mean of flushing that table ? If not, how can I lower the TCP
> > connection timeouts ?
> 
> Again, not really the right solution.   Find out what machine/s 
> is/are filling upyour conntrack tableand fix them so that they 
> don't.   A healthy network in normal operation doesn't fill up a 
> conntrack table.
> 
> Antony.
> 
> --
> 
> When do you expect the official release of the 2.6.0 kernel?
> 
> Rusty Russell: From previous releases, a pattern has emerged: 
> exactly 6 months before it's ready.                                  
>                    Please reply to the list;                         
>                                   please don't CC me.
------- End of Original Message -------




.


-----------------------------------------------------------------------
Information in this email may be privileged, confidential and is 
intended exclusively for the addressee.  The views expressed may
not be official policy, but the personal views of the originator.
If you have received it in error, please notify the sender by return
e-mail and delete it from your system.  You should not reproduce, 
distribute, store, retransmit, use or disclose its contents to anyone.
 
Please note we reserve the right to monitor all e-mail
communication through our internal and external networks.
-----------------------------------------------------------------------

RE: Forwarding GnomeMeeting to internal network

[Daniel Chemko]

If you are using a newish version of Netfilter, you can execute
something like the following:

echo "1000" >
/proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_close_wait

This would set TCP CLOSE_WAIT timeouts to 1000 seconds. The default
number is 3 days, so within that time, any traffic that does not close
the connection properly will linger inside the conntrack systems.

I don't have the option to fix the bad system. I do Nagios probes for
Windows 2000 RDP uptimes using tcp socket probing (I know I could use
RPC, blah blah), but the RDP connections are never fully closed by the
windows machine, so within a couple days of probing various servers, I
have quite a large conntrack table. 


-----Original Message-----
From: Julien Didron [mailto:admin@tripnotik.dyndns.org] 
Sent: Wednesday, November 12, 2003 5:11 AM
To: Netfilter Mailing List
Subject: Re: Forwarding GnomeMeeting to internal network

Hi again,


Thanks for the answer Antony.
I'll then grant this box a fixed IP using DHCP declaration with the MAC 
adress.

Concerning the ip_conntrack table, I indeed have a sort of worm on my
network 
called "MLdonkey" ;o) (it's on some other box on the network), process
that I 
kill everytime the problem occurs, but with no success : i still get the
very 
same error line in syslog.
after increasing the value of ip_conntrack_max, I monitored the traffic
on 
the outgoing interface, that was very little : say from 150B/s to 500B/s
up 
and down.
For information my local network (this is home) is composed of 4
machines 
ranging from mail server (smtp and pop) to DDNS, DHCP and web server ...
But 
I really don't think it to be a "large" network :o)