On July 9, 2004 11:23 am, Olivier.Keunen@xxxxxxxxxxxxxxxxxxxxxx wrote: > Hello, > > Here is the problem I hope somebody on the list can help me with: > > We have been running iptables on a Debian Linux box for some times. It > works fine, except that from time to time, one of the server in the farm > is denied access through the firewall for a while without any evidenced of > what is causing the default nor what fixes it ! Traffic through the > firewall from other servers in the farm still flows normally in the > meantime. The box is somewhat loaded as it runs a Windows 2000 DC, DNS, > DHCP & mail services, but it seems to work fine for what I can tell. > > We have both nating & filtering rules as follow (where x.x. & y.y. replace > the external & internal network IP ranges): > > # Generated by iptables-save v1.2.6a on Thu Jan 22 14:47:03 2004 > *mangle Greetings Oliver: 1) please don't use iptables-save output -- it isn't easy to read, and is often unclear on certain details .. Most here prefer (from what I've seen) to see the output from iptables -L -n -v -x and iptables -L -n -v -x -t [ nat/mangle ] for analysis -- or the script that actually loads the rules.. 2) Same box every time? Same problem every time? *takes a quick glance at the rules* -- have you completely eliminated all components on the windows box and what I presume is a switch that sits between linux / windows? -- this sounds like a GigE card problem we were having on win2k boxen running as DC's ... they were plugged into 100Mb Ethernet ports on a cisco .. and apparently the cards would try to step up to 1000Mb once in a while --- hard setting the speed fixed the problem. AutosenseLESS is my motto... 3) I would strongly reccommend that the next instance of this problem you insert LOG rules at the top of FORWARD and INPUT for the source IP and see if you are actually getting the packets, and possibly see why your rules might be dropping them. LOGged packets will go to your default syslog -- whereever that might be on Deb. > Could it be related to the [232015:19489204] -A INPUT -p icmp -m icmp > --icmp-type 8 -m limit --limit 6/sec -j ACCEPT rule that was set to avoid > "ping of death" attacks I highgly doubt it unless all the communication you are referring to is ICMP. This rule is limited to ICMP and should not drop TCP or UDP. You might not be able to ping out for a while, but the rule is fairly relaxed .. someone once posted an excellent explaination of the timing buckets for this, but it is slightly beyond my recall at the moment. Alistair Tonner > Thanks in advance to whoever can help... > > Olivier.
