ACK being dropped

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



I'm forwarding this message that I posted the the LARTC mailing list
here as well since I'm pressed for time and am looking for as much
feedback to get this working. (I'm not (currently) subscribed so
please do a CC to the Reply-To header if possible.)

The message below is a clarification of an early e-mail that I
sent. The original has some more information (e.g., which commands I
ran in what order) and is available online at:

http://mailman.ds9a.nl/pipermail/lartc/2004q2/012664.html

I also posted it to comp.os.linux.networking
(<863c53xef1.fsf@xxxxxxxxxxxxxxxx>):

http://groups.google.ca/groups?selm=863c53xef1.fsf%40number6.magda.ca

----- Forwarded message from David Magda <dmagda+lartc@xxxxxxxxxxxxx> -----

On Thu, Jun 10, 2004 at 03:35:49PM -0400, David Magda wrote:
[...]
>                   ______
>                   |    |- ppp0 -- Dynamic IP (PPPoE on eth2)
> Internal---- eth0 | GW |
>                   |____|- eth1 -- Static IP -> Static's GW
>
[...]
> Using tcpdump I get the following results. This is listening on
> eth1 as I try to SSH to the destination from an internal box (using
> lynx to connect to the same destination results in a web page):
[...]

Examing the output of tcpdump a bit more closely, it seems that the
host where the SSH client is trying to connect from never gets the
ACK in the TCP setup handshake. It's being sent by the server, it's
received on the external interface of the the gateway, but it never
makes it to the internal network.

The client machine keeps trying to setup a TCP connection, but never
receives the ACK. This is the interface (the client keeps trying to
setup the TCP connection):

tcpdump: listening on eth0
02:26:10.873080 [SSH client].37705 > [SSH server].22: S        \
    769441999:769441999(0) win 5840 <mss 1460,sackOK,timestamp \
    6184875090,nop,wscale 0> (DF) [tos 0x10]
02:26:13.866409 [SSH client].37705 > [SSH server].22: S        \
    769441999:769441999(0) win 5840 <mss 1460,sackOK,timestamp \
    6184878090,nop,wscale 0> (DF) [tos 0x10]

The external interface is getting the ACK (not from the same session,
but gets the point accross):

02:26:11.527294 [GW Ext. IP].ssh > [SSH server].49161: P       \
    224:336(112) ack 1 win 10944 <nop,nop,timestamp 557609690  \
    1169951> (DF) [tos 0x10]

The ACK for the TCP connection setup is being sent by the server:

tcpdump: listening on fxp0
02:26:10.933176 [SSH server NATed].37705 > [SSH server].22: S  \
    769441999:769441999(0) win 5840 <mss 1400,sackOK,timestamp \
    6184875090,nop,wscale 0> (DF) [tos 0x10]
02:26:10.933226 [SSH server].22 > [SSH server NATed].37705: S  \
    1054657654:1054657654(0) ack 769442000 win 65535           \
    <mss 1452,nop,wscale0,nop,nop,timestamp 1071666 618487509> (DF)
02:26:13.923678 [SSH server].22 > [SSH server NATed].37705: S  \
    1054657654:1054657654(0) ack 769442000 win 65535           \
    <mss 1452,nop,wscale0,nop,nop,timestamp 1071966 618487509> (DF)
02:26:13.926659 [SSH server NATed].37705 > [SSH server].22: S  \
    769441999:769441999(0) win 5840 <mss 1400,sackOK,timestamp \
    6184878090,nop,wscale 0> (DF) [tos 0x10]
02:26:13.926712 [SSH server].22 > [SSH server NATed].37705: S  \
    1054657654:1054657654(0) ack 769442000 win 65535           \
    <mss 1452,nop,wscale0,nop,nop,timestamp 1071966 618487809> (DF)
02:26:19.923038 [SSH server].22 > [SSH server NATed].37705: S  \
    1054657654:1054657654(0) ack 769442000 win 65535           \
    <mss 1452,nop,wscale0,nop,nop,timestamp 1072566 618487809> (DF)

I've tried doing an SSH connection to multiple hosts and it's always
the same thing.

Here are my iptable rules:

gw2:~# iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  anywhere             anywhere
SNAT       all  --  anywhere             anywhere  to:<Static IP>

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

gw2:~# iptables -L -t mangle
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
MARK       tcp  --  192.168.108.0/24     anywhere           tcp \
    dpt:ssh MARK set 0x4

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

IP rule list:

gw2:~# ip rule list
0:      from all lookup local
32765:  from all fwmark        4 lookup 4
32766:  from all lookup main
32767:  from all lookup default

Routing tables:

gw2:/home/mpathix# ip route show table main
<PPPoE peer> dev ppp0  proto kernel  scope link  src 69.158.104.154
63.250.109.128/29 dev eth1  proto kernel  scope link  src
    <Static IP>
192.168.108.0/24 dev eth0  proto kernel  scope link  src
    <GW's Internal IP>
default via <PPPoE peer> dev ppp0

gw2:/home/mpathix# ip route show table 4
<PPPoE peer> dev ppp0  proto kernel  scope link  src 69.158.104.154
63.250.109.128/29 dev eth1  proto kernel  scope link  src
    <Static IP>
192.168.108.0/24 dev eth0  proto kernel  scope link  src
    <Static IP>
default via <Static's GW>  dev eth1

So basically packets are getting out, but they're not getting back
in.

Any suggestions?

----- End forwarded message -----


[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux