From: Firstname Lastname <forbiddentransition@gmail.com>
To: netfilter@vger.kernel.org
Subject: iptables and the owner module
Date: Tue, 27 Mar 2012 19:45:21 -0400 [thread overview]
Message-ID: <20120327194521.00a33d86@gmail.com> (raw)
Iptables is dropping network connections to google.com (and bing.com) for a reason that is unclear.
Iptables is configured with the owner module and is set to ACCEPT outgoing packets matching '--uid-owner 1000'.
Subsequently, packets that do not match '--uid-owner 1000' and are associated with an open socket are logged then dropped.
The relevant lines in the iptables configuration are indicated below:
...
-A OUTPUT -o eth0 -p tcp -m tcp --sport 32768:61000 -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -m owner --uid-owner 1000 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --sport 32768:61000 -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -m owner --socket-exists -j LOG --log-tcp-options --log-ip-options --log-uid --log-level 7
-A OUTPUT -o eth0 -p tcp -m tcp --sport 32768:61000 -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -m owner --socket-exists -j DROP
...
The following log output is generated prior to being dropped:
IN= OUT=eth0 SRC=192.168.2.2 DST=173.194.73.103 LEN=60 TOS=0x00 PREC=0x00 TTL=40 ID=7363 DF PROTO=TCP SPT=58642 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A1D88900B0000000001030307) UID=1000 GID=1000
As indicated in the log output, the packet socket's file structure is owned by userid 1000 and thus should match the preceding configuration line with the ACCEPT target.
Any suggestions as to why iptables is dropping the packet and/or why it's specific to google.com (and bing.com)?
Running Debian Squeeze (kernel 2.6.32 or 3.2.9) with iptables (1.4.8-3).
I can provide additional info if necessary.
Thanks in advance.
next reply other threads:[~2012-03-27 23:45 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-03-27 23:45 Firstname Lastname [this message]
2012-03-28 1:32 ` iptables and the owner module Jan Engelhardt
2012-03-28 16:43 ` Firstname Lastname
2012-03-28 20:48 ` Jan Engelhardt
2012-03-29 17:52 ` Firstname Lastname
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120327194521.00a33d86@gmail.com \
--to=forbiddentransition@gmail.com \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).