Shorewall users - Apr 2008 - Re: Attached traceroute output !!Help

kernel.2k5 wrote:
> Hi ,
> 
> we are running mandriva 2008 HP Server with Firewall as Shorewall .
> 
> we have noticed some of the web sites we are never able to reach via web
> browser , So i thought of Attaching  png image of traceroute , Kindly
> can any one
> help me to Detect the Problem by reading the Output of traceroute
> 
> Server with 2 NIC''s :
> 
> eth0 : 203.123.162.X
> eth1: 192.168.10.2
> 
> All LAN clients connects via Transparent Proxy and rules mention inside
> policy File of Shorewall.
> 
> Now nobody even server is able to open this website to which i did
> traceroute any clue .where is the mistake happen.
> 
> I did :
> 
> #traceroute fotostick.com
> 
> and out put is attached with this mail.
Since you can get to Level3 in the U.S., it''s extremely unlikely that
this has anything to do with Shorewall, or even with your system.  It
could be a routing problem at one of the ISPs between you and the
destination site, or there could be an administrative block.

FWIW, here''s my traceroute:

...
 6  202.139.19.37 (202.139.19.37)  35.994 ms  35.993 ms  35.387 ms
 7  203.208.148.17 (203.208.148.17)  186.839 ms  187.243 ms  185.755 ms
 8  xe-9-2-0.edge3.LosAngeles1.Level3.net (4.78.195.201)  186.571 ms
219.592 ms  184.480 ms
 9  vlan89.csw3.LosAngeles1.Level3.net (4.68.20.190)  195.211 ms *
vlan79.csw2.LosAngeles1.Level3.net (4.68.20.126)  195.584 ms
10  ae-63-63.ebr3.LosAngeles1.Level3.net (4.69.137.33)  197.455 ms
ae-83-83.ebr3.LosAngeles1.Level3.net (4.69.137.41)  191.454 ms
ae-93-93.ebr3.LosAngeles1.Level3.net (4.69.137.45)  196.595 ms
11  ae-2.ebr3.SanJose1.Level3.net (4.69.132.9)  200.462 ms  197.265 ms
199.026 ms
12  ae-63-63.csw1.SanJose1.Level3.net (4.69.134.226)  207.205 ms
195.628 ms  198.053 ms
13  ae-62-62.ebr2.SanJose1.Level3.net (4.69.134.209)  203.012 ms
194.818 ms  198.026 ms
14  ae-3.ebr1.Denver1.Level3.net (4.69.132.58)  225.269 ms  233.841 ms
234.533 ms
15  ae-1-100.ebr2.Denver1.Level3.net (4.69.132.38)  221.261 ms  230.954
ms  234.810 ms
16  ae-3.ebr3.Chicago1.Level3.net (4.69.132.62)  250.382 ms  251.956 ms
 252.706 ms
17  ae-78.ebr2.Chicago1.Level3.net (4.69.134.61)  249.632 ms  247.243 ms
 253.177 ms
18  ae-21-54.car1.Chicago1.Level3.net (4.68.101.98)  244.254 ms  246.543
ms ae-21-56.car1.Chicago1.Level3.net (4.68.101.162)  245.676 ms
19  WBS-CONNECT.edge5.Chicago1.Level3.net (4.71.182.14)  246.161 ms
245.552 ms  244.791 ms
20  lw-core1-ge3.rtr.liquidweb.com (209.59.157.10)  245.731 ms  245.044
ms  249.032 ms
21  lw-core3-ge1.rtr.liquidweb.com (209.59.157.86)  247.373 ms  246.492
ms  247.904 ms
22  lw-dc2-dist4-ge1.rtr.liquidweb.com (209.59.157.126)  247.437 ms
248.497 ms  247.428 ms
23  72.52.254.67 (72.52.254.67)  246.942 ms  247.520 ms  247.078 ms

You''re only 1 step away from hitting their web server.  Perhaps
you''ve
been blocked by their host firewall for doing something one too many times?

Paul


-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Don''t miss this year''s exciting event. There''s still
time to save $100.
Use priority code J8TL2D2. 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone

> kernel.2k5 wrote:
Hmm, I don't recall having seen the original post. :/
> > we have noticed some of the web sites we are never able to reach via
web
> > browser ,
Did you try pinging them, does that work?

Problems accessing *some* sites only by *browser*, sounds familiar. You
probably missed to enable MSS CLAMPING.

# grep ^CLAMPMSS /etc/shorewall/shorewall.conf
CLAMPMSS=Yes

Just a guess, but in the past this has commonly proven to be the issue
for the above generic and vague problem description.

  karsten


-- 
[ESR] Eric S. Raymond: "How To Ask Questions The Smart Way"
      http://www.catb.org/~esr/faqs/smart-questions.html
[SGT] Simon G. Tatham: "How to Report Bugs Effectively"
      http://www.chiark.greenend.org.uk/~sgtatham/bugs.html


-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Don't miss this year's exciting event. There's still time to save
$100.
Use priority code J8TL2D2. 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Karsten Bräckelmann wrote:
>> kernel.2k5 wrote:
> 
> Hmm, I don''t recall having seen the original post. :/
>
I didn''t see it either...

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key



-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Don''t miss this year''s exciting event. There''s still
time to save $100.
Use priority code J8TL2D2. 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone

Tom Eastep wrote:
> Karsten Bräckelmann wrote:
>>> kernel.2k5 wrote:
>>
>> Hmm, I don''t recall having seen the original post. :/
>>
> 
> I didn''t see it either...
Looks like it originated from gmane.org and was cross-posted.  Perhaps
sf.net''s mailman blocked it because of that.

Paul


-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Don''t miss this year''s exciting event. There''s still
time to save $100.
Use priority code J8TL2D2. 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone