On Tue, Jan 6, 2009 at 13:41, Artūras Šlajus <x11@xxxxxxxxxxx> wrote:> Hello fellow netfilter users,>> I have a strange problem and I think I should blame my ISP for that...>> Recently I lost connectivity to some sites (i.e. digg.com, yahoo). The best> part is that I can regain connectivity by clearing out all the rules from> iptables.>> So if I have empty chains - I can connect to digg. After I add one rule:>> iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -j MASQUERADE (or SNAT,> doesn't make a difference)>> and bam! in 3-5 seconds I lose connectivity to these sites. Others work just> fine.>> The delay of impact is one thing that bothers me and makes me wonder about> magic in ISP side.>> Other thingie is if I do:>> iptables -t nat -I POSTROUTING -s 192.168.0.0/16 -j DROP>> After 3-5 seconds I regain connectivity... It seems that my ISP is somehow> monitoring nat'ing and dropping access to some sites...>> Any ideas why could this be happening and what is so special about digg.com> and some of yahoo servers that they connectivity to them get affected like> this?>> Any ideas welcome.>> Thanks, Arthur.
Has your ISP ever indicated hostility verbally, or in writing, towardNAT? Is it forbidden by your Terms of Service?
I find it difficult to believe that your ISP would do something soelaborate to discourage NAT, especially if they don't explicitlyforbid it. Try disconnecting your lan from this machine, and testingfor this anomaly. I suspect one of the machines on your lan may beattacking yahoo or digg, and causing those sites to temporarily blockyour [public] IP.’ōčŗ{.nĒ+?·?®??+%?Ė’±éŻ¶„?w’ŗ{.nĒ+?·§z×ā?׫ž)ķ?ęčw* jg¬±Ø ¶????Ż¢j’¾«žG«?é’¢ø ¢·¦j:+v?Ø?wčjŲm¶?’žų Æł ®w„ž?ąžf£¢·h??ā?ś’?Ł„
