weird netfilter problem

weird netfilter problem

[Mike O]

Im trying to track down a problem Im having with iptables. For some reason 
the internal machines cannot reach the internet until I ping them from the 
iptables box. I check the conntrack tables and there still valid entries in 
there for that machine. if I reboot it works for about 5 minutes then stops. 
I tried upgrading the kernel to 2.4.26 and iptables 1.2.11 and the same 
problem happens. Any ideas? this was working fine for over 6 months then 
just starts doing this.

-Mike

Re: weird netfilter problem

[Antony Stone]

On Tuesday 29 June 2004 2:02 pm, Mike O wrote:

> Im trying to track down a problem Im having with iptables. For some reason
> the internal machines cannot reach the internet until I ping them from the
> iptables box. I check the conntrack tables and there still valid entries in
> there for that machine. if I reboot it works for about 5 minutes then
> stops. I tried upgrading the kernel to 2.4.26 and iptables 1.2.11 and the
> same problem happens. Any ideas? this was working fine for over 6 months
> then just starts doing this.

Sounds like the client machines can't do ARP resolution for the IP address of 
the gateway.

I would suspect:

1. The NIC on the firewall.
2. The switch on your LAN.

Wait until one of the clients cannot get to the Internet, then examine its ARP 
cache ("arp -an" on Linux, not sure about other O/Ss), and see if it has a 
complete entry for the IP address of the firewall's internal interface.

Then do your ping and repeat the ARP check.

Regards,

Antony.

-- 
"The future is already here.   It's just not evenly distributed yet."

 - William Gibson

                                                     Please reply to the list;
                                                           please don't CC me.

Re: weird netfilter problem

[Mike O]

Did some more testing seems I can ping the private side of the box, but not 
the public side...this a conntrack issue maybe? then when I ping internal 
from the firewall it works.

>From: Antony Stone <Antony@Soft-Solutions.co.uk>
>Reply-To: netfilter@lists.netfilter.org
>To: netfilter@lists.netfilter.org
>Subject: Re: weird netfilter problem
>Date: Tue, 29 Jun 2004 14:12:02 +0100
>
>On Tuesday 29 June 2004 2:02 pm, Mike O wrote:
>
> > Im trying to track down a problem Im having with iptables. For some 
>reason
> > the internal machines cannot reach the internet until I ping them from 
>the
> > iptables box. I check the conntrack tables and there still valid entries 
>in
> > there for that machine. if I reboot it works for about 5 minutes then
> > stops. I tried upgrading the kernel to 2.4.26 and iptables 1.2.11 and 
>the
> > same problem happens. Any ideas? this was working fine for over 6 months
> > then just starts doing this.
>
>Sounds like the client machines can't do ARP resolution for the IP address 
>of
>the gateway.
>
>I would suspect:
>
>1. The NIC on the firewall.
>2. The switch on your LAN.
>
>Wait until one of the clients cannot get to the Internet, then examine its 
>ARP
>cache ("arp -an" on Linux, not sure about other O/Ss), and see if it has a
>complete entry for the IP address of the firewall's internal interface.
>
>Then do your ping and repeat the ARP check.
>
>Regards,
>
>Antony.
>
>--
>"The future is already here.   It's just not evenly distributed yet."
>
>  - William Gibson
>
>                                                      Please reply to the 
>list;
>                                                            please don't CC 
>me.
>
>

Re: weird netfilter problem

[Antony Stone]

On Tuesday 29 June 2004 4:27 pm, Mike O wrote:

> Did some more testing seems I can ping the private side of the box, but not
> the public side...this a conntrack issue maybe? then when I ping internal
> from the firewall it works.

I don't see why you should need to ping the public side of the firewall in 
order to route packets through it from the private LAN?

If you think connection tracking may be having problems, what do you get for 
"wc -l </proc/net/ip_conntrack"?   That is a count of the number of 
concurrent connections through (or to / from) the machine.

Regards,

Antony.

> From: Antony Stone <Antony@Soft-Solutions.co.uk>
>
> >Reply-To: netfilter@lists.netfilter.org
> >To: netfilter@lists.netfilter.org
> >Subject: Re: weird netfilter problem
> >Date: Tue, 29 Jun 2004 14:12:02 +0100
> >
> >On Tuesday 29 June 2004 2:02 pm, Mike O wrote:
> > > Im trying to track down a problem Im having with iptables. For some
> >reason
> > > the internal machines cannot reach the internet until I ping them from
> >the
> > > iptables box. I check the conntrack tables and there still valid
> > > entries
> >in
> > > there for that machine. if I reboot it works for about 5 minutes then
> > > stops. I tried upgrading the kernel to 2.4.26 and iptables 1.2.11 and
> >the
> > > same problem happens. Any ideas? this was working fine for over 6
> > > months then just starts doing this.
> >
> >Sounds like the client machines can't do ARP resolution for the IP address
> >of the gateway.
> >
> >I would suspect:
> >
> >1. The NIC on the firewall.
> >2. The switch on your LAN.
> >
> >Wait until one of the clients cannot get to the Internet, then examine its
> >ARP
> >cache ("arp -an" on Linux, not sure about other O/Ss), and see if it has a
> >complete entry for the IP address of the firewall's internal interface.
> >
> >Then do your ping and repeat the ARP check.
> >
> >Regards,
> >
> >Antony.

-- 
Microsoft may sell more software than any other company, but McDonald's sell 
more burgers than any other company, and I think the other similarities are 
obvious...

                                                     Please reply to the list;
                                                           please don't CC me.