В Чтв, 13/11/2008 в 10:33 +0200, Покотиленко Костик пишет: > В Чтв, 13/11/2008 в 07:52 +0000, TheOldFellow пишет: > > My firewall works well, except that I can't get any kind of access to > > www.adobe.com. > > > > This is typical: > > > > # ping www.adobe.com > > PING www.wip3.adobe.com (192.150.18.101): 56 data bytes > > 64 bytes from 192.150.18.101: icmp_seq=0 ttl=243 time=194.939 ms > > 64 bytes from 192.150.18.101: icmp_seq=1 ttl=243 time=193.576 ms > > 64 bytes from 192.150.18.101: icmp_seq=2 ttl=243 time=194.612 ms > > 64 bytes from 192.150.18.101: icmp_seq=3 ttl=243 time=194.844 ms > > --- www.wip3.adobe.com ping statistics --- > > 4 packets transmitted, 4 packets received, 0% packet loss > > round-trip min/avg/max/stddev = 193.576/194.493/194.939/0.542 ms > > > > so far so good... > > > > # wget http://www.adobe.com/index.html > > --07:45:04-- http://www.adobe.com/index.html > > => `index.html' > > Resolving www.adobe.com... 192.150.18.101 > > Connecting to www.adobe.com|192.150.18.101|:80... > > > > it just times out - browsers are the same. > > > > Looking at the log shows the following warnings: > > > > IPTABLES:INPUT IN=net OUT= MAC=00:a0:c9:43:8f:77:00:90:96:f7:74:42:08:00 SRC=192.150.18.101 DST=192.168.1.2 LEN=44 TOS=0x00 PREC=0x00 TTL=53 ID=9637 PROTO=TCP SPT=80 DPT=3723 WINDOW=20498 RES=0x00 URGP=0 > > IPTABLES:INPUT IN=net OUT= MAC=00:a0:c9:43:8f:77:00:90:96:f7:74:42:08:00 SRC=192.150.18.101 DST=192.168.1.2 LEN=44 TOS=0x00 PREC=0x00 TTL=53 ID=45688 PROTO=TCP SPT=80 DPT=3723 WINDOW=20498 RES=0x00 URGP=0 > > IPTABLES:INPUT IN=net OUT= MAC=00:a0:c9:43:8f:77:00:90:96:f7:74:42:08:00 SRC=192.150.18.101 DST=192.168.1.2 LEN=44 TOS=0x00 PREC=0x00 TTL=53 ID=37819 PROTO=TCP SPT=80 DPT=3723 WINDOW=20498 RES=0x00 URGP=0 > > It does seem strange for www.adobe.com to have privat IP 192.150.18.101 > which is also as I can see the IP of your box. You are pinging your > local box but there are no web server on your box as I see. Either you > edited addresses wrong or your DNS server (or /etc/hosts) has wrong > record for www.adobe.com. Sorry, I got it wrong, 192.150.18.101 is not privat, it's really address of www.adobe.com About your logs, if you use -j LOG -j DROP scheme, just find the blocking rule. -- Покотиленко Костик <casper@xxxxxxxxxxxx> -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
