* iptables sporadic "sendmsg: operation not permitted" problem and packet loss @ 2009-03-07 21:33 Dennis Jacobfeuerborn 2009-03-09 13:33 ` Gáspár Lajos 2009-03-09 20:12 ` Mart Frauenlob 0 siblings, 2 replies; 4+ messages in thread From: Dennis Jacobfeuerborn @ 2009-03-07 21:33 UTC (permalink / raw) To: netfilter Hi, I'm running into a problem on a machine that right now acts as a simple gateway but is supposed to become a firewall too. When I start iptables using "/etc/init.d/iptables start" on the Centos 5.2 machine first everything works fine but after about 30 seconds I'm seeing packet loss and running a ping outputs "sendmsg: operation not permitted" sporadically. The moment I stop iptables again everything returns to normal. What is consufing to me is that I don't even have any rules defined so far. This is what my "/etc/sysconfig/iptables" file looks like: # Generated by iptables-save v1.3.5 on Thu Mar 5 17:40:28 2009 *filter :INPUT ACCEPT [26715202:4750206096] :FORWARD ACCEPT [1382646771:1563210213960] :OUTPUT ACCEPT [22930985:6256734041] COMMIT iptables -L says: Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Does anyone have an idea why that would have such a severe impact on the traffic? The fact that it takes a moment for the problems to show up makes me suspect some kind of buffer issue so that the packet loss only begins to occur after some buffer begins to overflow. That just a guess though and I have no idea what buffer that could be. Regards, Dennis ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: iptables sporadic "sendmsg: operation not permitted" problem and packet loss 2009-03-07 21:33 iptables sporadic "sendmsg: operation not permitted" problem and packet loss Dennis Jacobfeuerborn @ 2009-03-09 13:33 ` Gáspár Lajos 2009-03-09 15:11 ` Dennis J. 2009-03-09 20:12 ` Mart Frauenlob 1 sibling, 1 reply; 4+ messages in thread From: Gáspár Lajos @ 2009-03-09 13:33 UTC (permalink / raw) To: Dennis Jacobfeuerborn; +Cc: netfilter Dennis Jacobfeuerborn írta: > Hi, > > I'm running into a problem on a machine that right now acts as a > simple gateway but is supposed to become a firewall too. When I start > iptables using "/etc/init.d/iptables start" on the Centos 5.2 machine > first everything works fine but after about 30 seconds I'm seeing > packet loss and running a ping outputs "sendmsg: operation not > permitted" sporadically. > The moment I stop iptables again everything returns to normal. What is > consufing to me is that I don't even have any rules defined so far. > This is what my "/etc/sysconfig/iptables" file looks like: > > # Generated by iptables-save v1.3.5 on Thu Mar 5 17:40:28 2009 > *filter > :INPUT ACCEPT [26715202:4750206096] > :FORWARD ACCEPT [1382646771:1563210213960] > :OUTPUT ACCEPT [22930985:6256734041] > COMMIT > > iptables -L says: > > Chain INPUT (policy ACCEPT) > target prot opt source destination > > Chain FORWARD (policy ACCEPT) > target prot opt source destination > > Chain OUTPUT (policy ACCEPT) > target prot opt source destination > > Does anyone have an idea why that would have such a severe impact on > the traffic? The fact that it takes a moment for the problems to show > up makes me suspect some kind of buffer issue so that the packet loss > only begins to occur after some buffer begins to overflow. That just a > guess though and I have no idea what buffer that could be. > > Regards, > Dennis > Hi Dennis, What about the other tables? iptables -vnL -t raw iptables -vnL -t mangle iptables -vnL -t nat Swifty ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: iptables sporadic "sendmsg: operation not permitted" problem and packet loss 2009-03-09 13:33 ` Gáspár Lajos @ 2009-03-09 15:11 ` Dennis J. 0 siblings, 0 replies; 4+ messages in thread From: Dennis J. @ 2009-03-09 15:11 UTC (permalink / raw) To: Gáspár Lajos; +Cc: Dennis Jacobfeuerborn, netfilter On 03/09/2009 02:33 PM, Gáspár Lajos wrote: > Dennis Jacobfeuerborn írta: >> Hi, >> >> I'm running into a problem on a machine that right now acts as a >> simple gateway but is supposed to become a firewall too. When I start >> iptables using "/etc/init.d/iptables start" on the Centos 5.2 machine >> first everything works fine but after about 30 seconds I'm seeing >> packet loss and running a ping outputs "sendmsg: operation not >> permitted" sporadically. >> The moment I stop iptables again everything returns to normal. What is >> consufing to me is that I don't even have any rules defined so far. >> This is what my "/etc/sysconfig/iptables" file looks like: >> >> # Generated by iptables-save v1.3.5 on Thu Mar 5 17:40:28 2009 >> *filter >> :INPUT ACCEPT [26715202:4750206096] >> :FORWARD ACCEPT [1382646771:1563210213960] >> :OUTPUT ACCEPT [22930985:6256734041] >> COMMIT >> >> iptables -L says: >> >> Chain INPUT (policy ACCEPT) >> target prot opt source destination >> >> Chain FORWARD (policy ACCEPT) >> target prot opt source destination >> >> Chain OUTPUT (policy ACCEPT) >> target prot opt source destination >> >> Does anyone have an idea why that would have such a severe impact on >> the traffic? The fact that it takes a moment for the problems to show >> up makes me suspect some kind of buffer issue so that the packet loss >> only begins to occur after some buffer begins to overflow. That just a >> guess though and I have no idea what buffer that could be. >> >> Regards, >> Dennis >> > > Hi Dennis, > > What about the other tables? > > iptables -vnL -t raw > iptables -vnL -t mangle > iptables -vnL -t nat All clear: [root@gw ~]# iptables -vnL -t raw Chain PREROUTING (policy ACCEPT 132 packets, 77370 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination [root@gw ~]# iptables -vnL -t mangle Chain PREROUTING (policy ACCEPT 2688M packets, 1487G bytes) pkts bytes target prot opt in out source destination Chain INPUT (policy ACCEPT 2048K packets, 368M bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 2686M packets, 1486G bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 1961K packets, 997M bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 2688M packets, 1487G bytes) pkts bytes target prot opt in out source destination [root@gw ~]# iptables -vnL -t nat Chain PREROUTING (policy ACCEPT 178 packets, 40798 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 121 packets, 26962 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Regards, Dennis ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: iptables sporadic "sendmsg: operation not permitted" problem and packet loss 2009-03-07 21:33 iptables sporadic "sendmsg: operation not permitted" problem and packet loss Dennis Jacobfeuerborn 2009-03-09 13:33 ` Gáspár Lajos @ 2009-03-09 20:12 ` Mart Frauenlob 1 sibling, 0 replies; 4+ messages in thread From: Mart Frauenlob @ 2009-03-09 20:12 UTC (permalink / raw) To: netfilter netfilter-owner@vger.kernel.org wrote: > Hi, > > I'm running into a problem on a machine that right now acts as a > simple gateway but is supposed to become a firewall too. When I start > iptables using "/etc/init.d/iptables start" on the Centos 5.2 machine > first everything works fine but after about 30 seconds I'm seeing > packet loss and running a ping outputs "sendmsg: operation not > permitted" sporadically. > The moment I stop iptables again everything returns to normal. What is > consufing to me is that I don't even have any rules defined so far. > This is what my "/etc/sysconfig/iptables" file looks like: > > # Generated by iptables-save v1.3.5 on Thu Mar 5 17:40:28 2009 > *filter > :INPUT ACCEPT [26715202:4750206096] > :FORWARD ACCEPT [1382646771:1563210213960] > :OUTPUT ACCEPT [22930985:6256734041] > COMMIT > > iptables -L says: > > Chain INPUT (policy ACCEPT) > target prot opt source destination > > Chain FORWARD (policy ACCEPT) > target prot opt source destination > > Chain OUTPUT (policy ACCEPT) > target prot opt source destination > > Does anyone have an idea why that would have such a severe impact on > the traffic? The fact that it takes a moment for the problems to show > up makes me suspect some kind of buffer issue so that the packet loss > only begins to occur after some buffer begins to overflow. That just a > guess though and I have no idea what buffer that could be. > > Regards, > Dennis > Hello, sounds like something that happend to me, when I accidentally did set ip_conntrack_max to `1'. If you don't know where it's located do some like: find /proc/sys/net -name ip_conntrack_max Maybe it's that issue, maybe not - just a guess. Greets Mart ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2009-03-09 20:12 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2009-03-07 21:33 iptables sporadic "sendmsg: operation not permitted" problem and packet loss Dennis Jacobfeuerborn 2009-03-09 13:33 ` Gáspár Lajos 2009-03-09 15:11 ` Dennis J. 2009-03-09 20:12 ` Mart Frauenlob
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox