Hi list,
I found the problem and the solution... :D
I was just trying to find the bug when I simply started tcpdump... and
it all started to work...
I did not told you that the LAN is a bridge with an ethernet interface
on one side and a vpn on the other side...
And somehow the PROMISC flag was deleted on this interface on the "A"
firewall... (tcpdump sets and resets this flag...)
Can anyone explain it to me why it is needed to have a PROMISC flag for
the triangle setup?
Thanx
Swifty
2011-12-07 18:57 keltezéssel, Gáspár Lajos írta:
Hi list,
I know that the answer is routing...
But...
I have a triangle problem...
Take this example:
"A": the local router/gateway/firewall connected to the Internet and
the LAN
"B": a server on the LAN
"C": a client on the same LAN or on the other side (Internet)
If "C" connects from the Internet to a service on "A" (in reality the
service is on "B") then everything is fine because I can DNAT the
packets to "B"...
But if "C" is in the LAN then the packets are simply disappearing...
I made some logging and the !!LAST!! TRACE in my syslog is (a bit
cleaned up version):
Dec 7 18:35:55 TRACE: nat:PRE_LAN_POP3:rule:1 IN=br1 OUT=
PHYSIN=vlan100 SRC=LAN_IP_OF_C DST=WAN_IP_OF_A PROTO=TCP SPT=59036
DPT=110 SEQ=3967862358 ACK=0 WINDOW=14600 RES=0x00 SYN URGP=0 OPT
(020405B40402080A26E062280000000001030304) MARK=0x5c
... and the rule:
#iptables -vnL PRE_LAN_POP3 -t nat
Chain PRE_LAN_POP3 (3 references)
pkts bytes target prot opt in out source
destination
12 720 DNAT tcp -- * * 0.0.0.0/0
!LAN_IP_OF_B to:LAN_IP_OF_B
So what happens next? Any thoughts?
sysctl settings:
net.ipv4.ip_forward = 1
net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.all.proxy_arp = 0
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.all.secure_redirects = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.proxy_arp = 0
net.ipv4.conf.default.rp_filter = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_abort_on_overflow = 1
net.ipv4.tcp_ecn = 2
net.ipv4.tcp_fack = 1
net.ipv4.tcp_low_latency = 1
net.ipv4.tcp_mtu_probing = 1
net.ipv4.tcp_sack = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_window_scaling = 1
net.ipv6.conf.all.disable_ipv6 = 1
Thanks for your help,
Swifty
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
