Jorge Fábregas wrote:
Ok, I've posted a similar setup I've used in the past that worked like a
charm. The script is the actual /etc/sysconfig/iptables. You'll notice
the syntax there is somehow different than when you manually create the
rules (or put in a script) but you get the idea. Those rules WERE THE
MINIMUM required in order to let a machine on internet reach a machine
on the internal network (port 8,555). Ask me any question if you don't
understand a line (please specify line number in question).
eth0 is WAN, eth1 is LAN. Notice how I use "-i" and "-o" for the NICs.
http://fpaste.org/sdPF/
I run very similar to this for my firewall, other than having two ISP
connections and having to load balance outgoing sockets in a strange way (some
clients accept only from one IP or another).
At this point tcpdump is your friend. I would be suspicious that the issue is
rule 8 you posted, but without the IP of all machines I can't be sure. You don't
note if the machine with failing DNS is using internal, external or both IPs, or
at least it's not totally clear to me. Your "Server2" is only on the external
net, so I presume that the IP is external.
In rule 8 you posted, I'm suspicious that something bizarre is happening, so you
might try blocking your firewall internal IP[1] or limit MASQ to connections you
initiate[2].
[1] ! -s ${my_internal_IP}
[2] -m state --state NEW
Just feels as if that is the isue, but tcpdump on the external side will tell
you what's happening if neither of those things change the problem.
HTH,
Jorge
--
Bill Davidsen <davidsen@xxxxxxx>
"We have more to fear from the bungling of the incompetent than from
the machinations of the wicked." - from Slashdot
--
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org
