thr3ads.net - Shorewall users - problem accesing a specific site [Jul 2005]

If this information is useful, please help other people find it:
Share via:

Marius Stan

2005-Jul-20 13:54 UTC

problem accesing a specific site

Hello all,

I''m having a hard time accessing a specific site (euroline-cards.ro) 
when shorewall is up, either from my masqueraded LAN, either from the 
shorewall machine itself.
After the initial connection, I seem to get no data back from this server.
As soon as I flush all rules, the above site is accessible.
I''ve already set CLAMP_MSS=Yes in shorewall.conf, but to no effect
My shorewall version is 2.2.5

Any more ideas ? Any more info I should come up with ?

Thanks,
Marius


-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click

Cristian Rodriguez

2005-Jul-20 17:14 UTC

head link

Re: problem accesing a specific site

Marius Stan wrote:> Hello all,
> 
> I''m having a hard time accessing a specific site
(euroline-cards.ro)
> when shorewall is up, either from my masqueraded LAN, either from the 
> shorewall machine itself.
> After the initial connection, I seem to get no data back from this server.
> As soon as I flush all rules, the above site is accessible.
> I''ve already set CLAMP_MSS=Yes in shorewall.conf, but to no effect
> My shorewall version is 2.2.5
same issue here.. destination host is probably broken, they even have a 
broken PTR record.

PING euroline-cards.ro (193.226.114.4) 56(84) bytes of data.
64 bytes from 4.114.226.193.in-addr.arpa (¡)

Jerry Vonau

2005-Jul-20 17:46 UTC

head link

Re: problem accesing a specific site

>> Hello all,
>>
>> I''m having a hard time accessing a specific site
(euroline-cards.ro)
>> when shorewall is up, either from my masqueraded LAN, either from the
>> shorewall machine itself.
>> After the initial connection, I seem to get no data back from this
server.>> As soon as I flush all rules, the above site is accessible.
>> I''ve already set CLAMP_MSS=Yes in shorewall.conf, but to no
effect
>> My shorewall version is 2.2.5
>same issue here.. destination host is probably broken, they even have a
>broken PTR record.
>PING euroline-cards.ro (193.226.114.4) 56(84) bytes of data.
>64 bytes from 4.114.226.193.in-addr.arpa (¡)
works for me:
[root@shore shorewall]# ping 193.226.114.4
PING 193.226.114.4 (193.226.114.4) 56(84) bytes of data.
64 bytes from 193.226.114.4: icmp_seq=0 ttl=112 time=190 ms
64 bytes from 193.226.114.4: icmp_seq=1 ttl=112 time=185 ms
64 bytes from 193.226.114.4: icmp_seq=2 ttl=112 time=186 ms
64 bytes from 193.226.114.4: icmp_seq=3 ttl=112 time=187 ms
64 bytes from 193.226.114.4: icmp_seq=4 ttl=112 time=195 ms

The web page loads, on a machine, in my masq lan.

Want to compare traceroutes?

Jerry




-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_idt77&alloc_id492&op=click

Marius Stan

2005-Jul-21 06:52 UTC

head link

Re: problem accesing a specific site

Jerry Vonau wrote:
>  
>
>>same issue here.. destination host is probably broken, they even have a
>>broken PTR record.
>>    
>>In what way is the PTR broken ?!
>
>  
>
>>PING euroline-cards.ro (193.226.114.4) 56(84) bytes of data.
>>64 bytes from 4.114.226.193.in-addr.arpa (¡)
>>    
>>
>
>works for me:
>[root@shore shorewall]# ping 193.226.114.4
>PING 193.226.114.4 (193.226.114.4) 56(84) bytes of data.
>64 bytes from 193.226.114.4: icmp_seq=0 ttl=112 time=190 ms
>The web page loads, on a machine, in my masq lan.
>
>Want to compare traceroutes?
>
>Jerry
>  
>The host isn''t broken. As soon as I flush the iptables rules the web 
site loads...
I''ve run out of ideas...

Marius


-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click

Marius Stan

2005-Jul-21 07:25 UTC

head link

Re: problem accesing a specific site

Sorry to reply to my own email and for the length of the message, but I 
just found another thing.
It may be a connection tracking issue, those with greater skills please 
confirm or infirm this.
Here''s a dump from the net interface:

# tcpdump -pX -i eth2 host euroline-cards.ro
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth2, link-type EN10MB (Ethernet), capture size 96 bytes
10:14:57.207419 IP cerf.134.75.rdsnet.ro.40351 > 
4.114.226.193.in-addr.arpa.http: S 3120277631:3120277631(0) win 5840 
<mss 1460,sackOK,timestamp 78193341 0,nop,wscale 2>
        0x0000:  4500 003c 8ac2 4000 4006 216a d45d 864b  E..<..@.@.!j.].K
        0x0010:  c1e2 7204 9d9f 0050 b9fb a87f 0000 0000  ..r....P........
        0x0020:  a002 16d0 7ad4 0000 0204 05b4 0402 080a  ....z...........
        0x0030:  04a9 22bd 0000 0000 0103 0302            ..".........
10:14:57.219702 IP 4.114.226.193.in-addr.arpa.http > 
cerf.134.75.rdsnet.ro.40351: S 2509256868:2509256868(0) ack 3120277632 
win 0 <mss 1380>
        0x0000:  4500 002c 90cd 0000 f906 a26e c1e2 7204  E..,.......n..r.
        0x0010:  d45d 864b 0050 9d9f 9590 38a4 b9fb a880  .].K.P....8.....
        0x0020:  6012 0000 3b36 0000 0204 0564 0000       `...;6.....d..
10:14:57.219726 IP cerf.134.75.rdsnet.ro.40351 > 
4.114.226.193.in-addr.arpa.http: . ack 1 win 5840
        0x0000:  4500 0028 8ac4 4000 4006 217c d45d 864b  E..(..@.@.!|.].K
        0x0010:  c1e2 7204 9d9f 0050 b9fb a880 9590 38a5  ..r....P......8.
        0x0020:  5010 16d0 3bd3 0000                      P...;...
10:14:57.230218 IP 4.114.226.193.in-addr.arpa.http > 
cerf.134.75.rdsnet.ro.40351: S 2509256868:2509256868(0) ack 3120277632 
win 16560 <mss 1380>
        0x0000:  4500 002c 90cf 0000 f906 a26c c1e2 7204  E..,.......l..r.
        0x0010:  d45d 864b 0050 9d9f 9590 38a4 b9fb a880  .].K.P....8.....
        0x0020:  6012 40b0 fa85 0000 0204 0564 0000       `.@........d..
10:14:57.230233 IP cerf.134.75.rdsnet.ro.40351 > 
4.114.226.193.in-addr.arpa.http: P 1:599(598) ack 1 win 5840
        0x0000:  4500 027e 8ac6 4000 4006 1f24 d45d 864b  E..~..@.@..$.].K
        0x0010:  c1e2 7204 9d9f 0050 b9fb a880 9590 38a5  ..r....P......8.
        0x0020:  5018 16d0 5b67 0000 4745 5420 2f20 4854  P...[g..GET./.HT
        0x0030:  5450 2f31 2e30 0d0a 486f 7374 3a20 7777  TP/1.0..Host:.ww
        0x0040:  772e 6575 726f 6c69 6e65 2d63 6172 6473  w.euroline-cards
        0x0050:  2e72                                     .r
10:14:57.249699 IP 4.114.226.193.in-addr.arpa.http > 
cerf.134.75.rdsnet.ro.40351: P 1:1042(1041) ack 599 win 15962
        0x0000:  4500 0439 85bf 4000 7a06 e86f c1e2 7204  E..9..@.z..o..r.
        0x0010:  d45d 864b 0050 9d9f 9590 38a5 b9fb aad6  .].K.P....8.....
        0x0020:  5018 3e5a d237 0000 4854 5450 2f31 2e31  P.>Z.7..HTTP/1.1
        0x0030:  2033 3032 2046 6f75 6e64 0d0a 436f 6e6e  .302.Found..Conn
        0x0040:  6563 7469 6f6e 3a20 6b65 6570 2d61 6c69  ection:.keep-ali
        0x0050:  7665                                     ve
10:15:00.229929 IP cerf.134.75.rdsnet.ro.40351 > 
4.114.226.193.in-addr.arpa.http: P 1:599(598) ack 1 win 5840
        0x0000:  4500 027e 8ac8 4000 4006 1f22 d45d 864b  E..~..@.@..".].K
        0x0010:  c1e2 7204 9d9f 0050 b9fb a880 9590 38a5  ..r....P......8.
        0x0020:  5018 16d0 5b67 0000 4745 5420 2f20 4854  P...[g..GET./.HT
        0x0030:  5450 2f31 2e30 0d0a 486f 7374 3a20 7777  TP/1.0..Host:.ww
        0x0040:  772e 6575 726f 6c69 6e65 2d63 6172 6473  w.euroline-cards
        0x0050:  2e72                                     .r
10:15:00.249309 IP 4.114.226.193.in-addr.arpa.http > 
cerf.134.75.rdsnet.ro.40351: P 1:1042(1041) ack 599 win 15962
        0x0000:  4500 0439 88c3 4000 7a06 e56b c1e2 7204  E..9..@.z..k..r.
        0x0010:  d45d 864b 0050 9d9f 9590 38a5 b9fb aad6  .].K.P....8.....
        0x0020:  5018 3e5a d237 0000 4854 5450 2f31 2e31  P.>Z.7..HTTP/1.1
        0x0030:  2033 3032 2046 6f75 6e64 0d0a 436f 6e6e  .302.Found..Conn
        0x0040:  6563 7469 6f6e 3a20 6b65 6570 2d61 6c69  ection:.keep-ali
        0x0050:  7665                                     ve
10:15:00.273671 IP 4.114.226.193.in-addr.arpa.http > 
cerf.134.75.rdsnet.ro.40351: P ack 599 win 15962
        0x0000:  4500 0028 8ac8 4000 3406 2d78 c1e2 7204  E..(..@.4.-x..r.
        0x0010:  d45d 864b 0050 9d9f 9590 3cb6 b9fb aad6  .].K.P....<.....
        0x0020:  5018 3e5a 0dda 0000 0000 0000 0000       P.>Z..........

As you can see, the host responded correctly at the fourth packet. Now 
for the loc interface:

# tcpdump -pX -i eth0 host euroline-cards.ro
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
10:14:57.198045 IP dominion.asesoft.intl.4396 > 
4.114.226.193.in-addr.arpa.http: S 4100818737:4100818737(0) win 16384 
<mss 1460,nop,nop,sackOK>
        0x0000:  4500 0030 0218 4000 8006 a40c c0a8 6014  E..0..@.......`.
        0x0010:  c1e2 7204 112c 0050 f46d 8731 0000 0000  ..r..,.P.m.1....
        0x0020:  7002 4000 6160 0000 0204 05b4 0101 0402  p.@.a`..........
10:14:57.198089 IP 4.114.226.193.in-addr.arpa.http > 
dominion.asesoft.intl.4396: S 3134613314:3134613314(0) ack 4100818738 
win 5840 <mss 1460,nop,nop,sackOK>
        0x0000:  4500 0030 0000 4000 4006 e624 c1e2 7204  E..0..@.@..$..r.
        0x0010:  c0a8 6014 0050 112c bad6 6742 f46d 8732  ..`..P.,..gB.m.2
        0x0020:  7012 16d0 6866 0000 0204 05b4 0101 0402  p...hf..........
10:14:57.198208 IP dominion.asesoft.intl.4396 > 
4.114.226.193.in-addr.arpa.http: . ack 1 win 17520
        0x0000:  4500 0028 0219 4000 8006 a413 c0a8 6014  E..(..@.......`.
        0x0010:  c1e2 7204 112c 0050 f46d 8732 bad6 6743  ..r..,.P.m.2..gC
        0x0020:  5010 4470 678a 0000 0000 0000 0000       P.Dpg.........
10:14:57.207055 IP dominion.asesoft.intl.4396 > 
4.114.226.193.in-addr.arpa.http: P 1:499(498) ack 1 win 17520
        0x0000:  4500 021a 021a 4000 8006 a220 c0a8 6014  E.....@.......`.
        0x0010:  c1e2 7204 112c 0050 f46d 8732 bad6 6743  ..r..,.P.m.2..gC
        0x0020:  5018 4470 4405 0000 4745 5420 2f20 4854  P.DpD...GET./.HT
        0x0030:  5450 2f31 2e31 0d0a 486f 7374 3a20 7777  TP/1.1..Host:.ww
        0x0040:  772e 6575 726f 6c69 6e65 2d63 6172 6473  w.euroline-cards
        0x0050:  2e72                                     .r
10:14:57.207101 IP 4.114.226.193.in-addr.arpa.http > 
dominion.asesoft.intl.4396: . ack 499 win 6432
        0x0000:  4500 0028 45f7 4000 4006 a035 c1e2 7204  E..(E.@.@..5..r.
        0x0010:  c0a8 6014 0050 112c bad6 6743 f46d 8924  ..`..P.,..gC.m.$
        0x0020:  5010 1920 90e8 0000                      P.......

Looks like the the response never got through, so my browser keeps 
issuing the GET requests until it times out..
I seem to recall a message from Tom on the list related to this 
connections being not-so-tracking but it remained unanswered...

Marius



-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click

Tom Eastep

2005-Jul-21 15:23 UTC

head link

Re: problem accesing a specific site

Marius Stan wrote:
> Looks like the the response never got through, so my browser keeps
> issuing the GET requests until it times out..
> I seem to recall a message from Tom on the list related to this
> connections being not-so-tracking but it remained unanswered...
Please try:

echo 1 > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal

If that corrects the problem, then I suggest putting this in your
/etc/shorewall/init file:

run_and_save_command "echo 1 >
/proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal"

-Tom
--
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key

Marius Stan

2005-Jul-22 07:11 UTC

head link

Re: problem accesing a specific site

Tom Eastep wrote:
>
>
>Please try:
>
>echo 1 > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal
>
>
>  
>Many thanks Tom, that seems to have solved my problem.

Marius


-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click

Shorewall users - Jul 2005 - problem accesing a specific site

problem accesing a specific site

Re: problem accesing a specific site

Re: problem accesing a specific site

Re: problem accesing a specific site

Re: problem accesing a specific site

Re: problem accesing a specific site

Re: problem accesing a specific site