Iptables is dropping network connections to google.com (and bing.com) for a reason that is unclear. Iptables is configured with the owner module and is set to ACCEPT outgoing packets matching '--uid-owner 1000'. Subsequently, packets that do not match '--uid-owner 1000' and are associated with an open socket are logged then dropped. The relevant lines in the iptables configuration are indicated below: ... -A OUTPUT -o eth0 -p tcp -m tcp --sport 32768:61000 -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -m owner --uid-owner 1000 -j ACCEPT -A OUTPUT -o eth0 -p tcp -m tcp --sport 32768:61000 -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -m owner --socket-exists -j LOG --log-tcp-options --log-ip-options --log-uid --log-level 7 -A OUTPUT -o eth0 -p tcp -m tcp --sport 32768:61000 -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -m owner --socket-exists -j DROP ... The following log output is generated prior to being dropped: IN= OUT=eth0 SRC=192.168.2.2 DST=173.194.73.103 LEN=60 TOS=0x00 PREC=0x00 TTL=40 ID=7363 DF PROTO=TCP SPT=58642 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A1D88900B0000000001030307) UID=1000 GID=1000 As indicated in the log output, the packet socket's file structure is owned by userid 1000 and thus should match the preceding configuration line with the ACCEPT target. Any suggestions as to why iptables is dropping the packet and/or why it's specific to google.com (and bing.com)? Running Debian Squeeze (kernel 2.6.32 or 3.2.9) with iptables (1.4.8-3). I can provide additional info if necessary. Thanks in advance. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
