Im stupid or its broken

Im stupid or its broken

[Mats Blomstrand]

Hi all
This is perhaps a stupid question. But I have *really* tried to
get it by reading FAQ's and tutorials all over all week long.
Please take some  time to help me out.

I have a master and a couple of nodes that need NAT from master.
If I boot master and nodes without any iptables stuff and then
add this rule to iptables

  root@wsk0 # iptables -t nat -A POSTROUTING -o eth0 \
              -s 192.168.0.0/24 -j SNAT --to-source 193.10.192.63

and the do

  root@wsk0 # echo 1 > /proc/sys/net/ipv4/ip_forward

it does what I want. Ie, i can ping from node to the outside
and the node can do nfs-mounts from master.

** However!! If I reboot the node it can still ping to the outside
but it cant no longer do the nfs mount:

  root@wsk9 # mount -t nfs wsk0.vip:/usr/local/share/ /usr/local/share/
  mount: RPC: Timed out
  root@wsk9 #

Every policy is ACCEPT and the above command is the ONLY thing
added to the nat-table.

Here is all the rules:
  root@wsk0 # service iptables status
  Table: filter
  Chain INPUT (policy ACCEPT)
  target     prot opt source               destination         
  
  Chain FORWARD (policy ACCEPT)
  target     prot opt source               destination         
  
  Chain OUTPUT (policy ACCEPT)
  target     prot opt source               destination         
  Table: nat
  Chain PREROUTING (policy ACCEPT)
  target     prot opt source               destination         
  
  Chain POSTROUTING (policy ACCEPT)
  target     prot opt source               destination         
  SNAT       all  --  192.168.0.0/24       anywhere           to:193.10.192.63 
  
  Chain OUTPUT (policy ACCEPT)
  target     prot opt source               destination         
  Table: mangle
  Chain PREROUTING (policy ACCEPT)
  target     prot opt source               destination         
  
  Chain OUTPUT (policy ACCEPT)
  target     prot opt source               destination         
  root@wsk0 # 


What is wrong??
//Mats

PS: Versions ...
  root@wsk0 # iptables --version
  iptables v1.2.3
  root@wsk0 # uname -sr
  Linux 2.4.7-10smp
  root@wsk0 # 
  

Re: Im stupid or its broken

[Anders Fugmann]

Mats Blomstrand wrote:
> 
>   root@wsk0 # iptables -t nat -A POSTROUTING -o eth0 \
>               -s 192.168.0.0/24 -j SNAT --to-source 193.10.192.63
> 
> and the do
> 
>   root@wsk0 # echo 1 > /proc/sys/net/ipv4/ip_forward
> 
> it does what I want. Ie, i can ping from node to the outside
> and the node can do nfs-mounts from master.
> 
> ** However!! If I reboot the node it can still ping to the outside
> but it cant no longer do the nfs mount:
This should work.

Could you please verify that you can do NFS-mounts without the rules
applied.

Also, does the server logs (/var/log/messages) tell you anything of why 
the node is not allowed to connect?

 > PS: Versions ...
 >   root@wsk0 # iptables --version
 >   iptables v1.2.3
 >   root@wsk0 # uname -sr
 >   Linux 2.4.7-10smp
 >   root@wsk0 #
thats some old version there.
I strongly suggest that you upgrade to kernel 2.4.19, and iptables >= 
1.2.7. These version are filled with bugs. Upgrading might (though I 
doubt it) help with the problem.

Regards
Anders Fugmann

--
Author of FIAIF
Fiaif Is An Intelligent Firewall
http://fiaif.fugmann.dhs.org

Re: Im stupid or its broken

[Antony Stone]

On Friday 13 September 2002 11:29 am, Mats Blomstrand wrote:

> Hi all
> This is perhaps a stupid question. But I have *really* tried to
> get it by reading FAQ's and tutorials all over all week long.
> Please take some  time to help me out.
>
> I have a master and a couple of nodes that need NAT from master.
> If I boot master and nodes without any iptables stuff and then
> add this rule to iptables
>
>   root@wsk0 # iptables -t nat -A POSTROUTING -o eth0 \
>               -s 192.168.0.0/24 -j SNAT --to-source 193.10.192.63
>
> and the do
>
>   root@wsk0 # echo 1 > /proc/sys/net/ipv4/ip_forward
>
> it does what I want. Ie, i can ping from node to the outside
> and the node can do nfs-mounts from master.
>
> ** However!! If I reboot the node it can still ping to the outside
> but it cant no longer do the nfs mount:
>
>   root@wsk9 # mount -t nfs wsk0.vip:/usr/local/share/ /usr/local/share/
>   mount: RPC: Timed out
>   root@wsk9 #

I see no reason why the situation should be different after rebooting the 
client machine.

Can you either add some LOGging rules to the INPUT chain on the nfs server to 
see whether it is getting packets for nfs, or else run a packet sniffer such 
as ethereal on the network joining the two machines, to see what's different 
before & after the reboot ?

Antony.

-- 

In science, one tries to tell people
in such a way as to be understood by everyone
something that no-one ever knew before.

In poetry, it is the exact opposite.

 - Paul Dirac