Arch doesn't respond to portforwarded connections

art84 · 2011-04-09 18:06:32

Hi everyone.
I didn't write here for some time, but now I'm stuck with an issue and I hope someone has a quick and obvious response to it.
It's a networking issue and it seems it is related to Arch / Linux.
Maybe it's not the best place to ask about this, but I think the issue is at Arch / Linux level, that's why this thread is here.

First of all, here is my network configuration/geometry (I know, it's weird, but it is like it is):

   --------
  (        )            SRV                  PC-A                 PC-B
 (          )     .---------------.    .---------------.    .---------------.
(  INTERNET  )===>| 95.12.34.56|  |    |   |192.168.1.1|===>| 192.168.1.5|  |
 (          )     |------------/  |    |   \-----------|    |------------/  |
  (        )      |               |    |               |    |               |
   --------       |               |    |               |    *---------------*
                  |   /-----------|    |------------\  |
                  |   |192.168.0.1|===>| 192.168.0.4|  | 
                  *---------------*    *---------------*

SRV and PC-A run Windows (well, not the best idea, but for now it's irrelevant).
PC-B runs Arch Linux (but it is a double-OS machine and it also has a Windows on it).

SRV has software which does firewalling, NAT, portforwarding and things like these.
PC-A has an identical sowftare package to do the same things (firewall, NAT, portforwarding, etc).

Now, when PC-B runs Windows, I can access it from SRV (tested using MySQL):
- on PC-B I start the "mysqld service" on port 3306
- on PC-A there is a rule to do portforwarding: PORT 3333 => PORT 3306 on 192.168.1.2
- on SRV I launch the "mysql client" and I can connect to PC-B by specifying host=192.168.0.4 and port 3333 (PC-A forwards the port to PC-B)
- I also can launch the "mysql client" on PC-A and connect to PC-B directly

When PC-B runs Arch Linux (everything is the same, the same IP, etc), I'm not able to connect from SRV, only from PC-A.
From Arch I'm able to access Internet.
Arch doesn't run any firewall, it uses only "hosts.allow" and "hosts.deny" (btw, is it possible to disable them? how?)
"hosts.allow" contains "mysqld : 192.168.1.1 192.168.0.1 192.168.0.4" to be sure every IP from this configuration is there.

I also tried to do the same using the Apache server and a browser (as client), other ports, but the same result: when running Windows it worked, when running Arch it did not.

Any ideas? What could be wrong?
Any help is welcome, even the direction where to digg further.

cactus · 2011-04-10 19:15:59

questions:
1) Is the PC-A to PC-B connection wired or wireless?
2) What is the error you get when trying to connect via mysql? (e.g. is it a mysql permission, or are you getting a tcp reset response)?

and for your question about how to disable hosts.(deny|allow) checking...
Just add this to your hosts.allow, and make sure your hosts.deny is empty.

ALL:ALL

Last edited by cactus (2011-04-10 19:21:03)

art84 · 2011-04-11 12:34:52

1) everything is wired, the networks work fine as hardware and drivers, I have no problems when accessing computers in both directions from PC-A or when accessing PC-A from PC-B
I have a suspicion that it could be something at 'routing' level, but it should not. It has a single NIC card and the default route is:

gateway="default gw 192.168.1.1"
ROUTES=(gateway)
---
# ip route show
192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.5
default via 192.168.1.1 dev eth0

Redirected packets have the source=192.168.0.1 and destination=192.168.1.5, maybe this is the problem, but they shoud be sent to eth0 anyway due to the default route (I mean the response to those packets).

2) it's the same error as one could get when trying to connect to an inaccessible computer or an inexistent IP/port

D:\web\apps\mysql\bin>mysql --host=192.168.0.4 --user=xxx --port=3333 --password=xxx
ERROR 2003 (HY000): Can't connect to MySQL server on '192.168.0.4' (10060)

3) I know about ALL:ALL and the used rules by hosts.allow/deny, I just meant to disable it completely (maybe it's a service or somewhere in the config) ... or is it a built-in mechanism compiled with the kernel? As I now, it's a BSD feature and other Linux ditros like Debian or RH don't have it.

And thank you for your intervention and help.

cactus · 2011-04-11 23:41:23

3) it is called tcp_wrappers, and it is a library, as well as a helper service proxy thing (tcpd -- used sometimes with inetd stuff). Also note that other distros DO have it. Not sure where you got the idea that it was bsd specific.

2) what do you get if you try to telnet to that port?

1) What does the firewall ruleset look like on pc-a and pc-b?

iptables -nvL && iptables -t nat -nvL

Arch Linux

#1 2011-04-09 18:06:32

Arch doesn't respond to portforwarded connections

#2 2011-04-10 19:15:59

Re: Arch doesn't respond to portforwarded connections

#3 2011-04-11 12:34:52

Re: Arch doesn't respond to portforwarded connections

#4 2011-04-11 23:41:23

Re: Arch doesn't respond to portforwarded connections

Board footer