You are not logged in.
Hello everyone,
I have a dedicated arch box acting as a NAT server for my home network:
(INTERNET)------([eth0]NAT[eth1])----(switch)----(various other pc's)
The whole network is static (edit: 192.168.0.0/24) , the real ip address of eth0 is also static.
Now recently something strange came to my attention, some packets don't get NAT'ed and try to exit through eth0. The best way to get this, is to launch a torrent client on one of the pc's behind the switch. However this is not limited to torrents - i've seen simple http packets do this too:
[root@shell ~]# tcpdump -i eth0 src net 192.168
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
12:56:24.397302 IP 192.168.0.2.1091 > ************************.56789: Flags [R], seq 1695624292, win 0, length 0
12:57:38.313657 IP 192.168.0.2.4876 > ************************.auth: Flags [FP.], seq 3478990450:3478990518, ack 183271552, win 65535, length 68
12:59:21.044643 IP 192.168.0.2.2015 > ************************.5654: Flags [R], seq 713398971, win 0, length 0
12:59:31.798359 IP 192.168.0.2.1483 > ************************.20652: Flags [F.], seq 1737355482, ack 170097931, win 65535, length 0
13:00:48.546446 IP 192.168.0.2.2352 > ************************.49940: Flags [FP.], seq 1357223267:1357223726, ack 1478303765, win 65007, length 459
the ************************'s are different hosts btw.
Cleared the whole iptables configuration, leaving just the NAT, same thing:
# Generated by iptables-save v1.4.6 on Sat Feb 13 13:18:07 2010
*mangle
:PREROUTING ACCEPT [17851581:6241124637]
:INPUT ACCEPT [588793:43163475]
:FORWARD ACCEPT [17261866:6197905556]
:OUTPUT ACCEPT [268587:453931663]
:POSTROUTING ACCEPT [17530354:6651942753]
COMMIT
# Completed on Sat Feb 13 13:18:07 2010
# Generated by iptables-save v1.4.6 on Sat Feb 13 13:18:07 2010
*nat
:PREROUTING ACCEPT [12797:909573]
:POSTROUTING ACCEPT [13:1172]
:OUTPUT ACCEPT [36:3171]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Sat Feb 13 13:18:07 2010
# Generated by iptables-save v1.4.6 on Sat Feb 13 13:18:07 2010
*raw
:PREROUTING ACCEPT [17851590:6241126544]
:OUTPUT ACCEPT [268587:453931663]
COMMIT
# Completed on Sat Feb 13 13:18:07 2010
# Generated by iptables-save v1.4.6 on Sat Feb 13 13:18:07 2010
*filter
:INPUT ACCEPT [4812:337357]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [4716:383220]
:SSH - [0:0]
-A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth1 -o eth0 -j ACCEPT
COMMIT
# Completed on Sat Feb 13 13:18:07 2010
No effect, the contrack queues look ok too:
[root@shell ~]# cat /proc/sys/net/nf_conntrack_max
7780
[root@shell ~]# cat /proc/net/nf_conntrack| wc
605 12954 134501
Quite frankly i have ran out of ideas of what could cause all of this, or am i just interpreting the output of tcpdump incorrectly?
Any help would be much appreciated.
Last edited by junaru (2010-02-13 11:41:24)
Offline
if eth0 is always static, why dont you NAT using SNAT instead of MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o eth0 -j SNAT --to-source <eth0 ip address>
Offline
if eth0 is always static, why dont you NAT using SNAT instead of MASQUERADE
Tried, same results.
Offline
what is the ip address and netmask of eth0 and eth1?
Offline
what is the ip address and netmask of eth0 and eth1?
eth0: 193.*.*.237 netmask 255.255.255.252 (thats 193. not 192.)
eth1 192.168.0.1 netmask 255.255.255.0
Offline
is this causing connectivity issues for the networked pc's?
try using iftop, and check its results.
Offline
is this causing connectivity issues for the networked pc's?
Not really, just got notified by the person managing the next hop that there are some strange packets coming from my end.
iftop is also able to detect them on eth0:
192.168.0.2 => *******************************.net.uy 0b 0b 8b
<= 0b 0b 0b
Offline
try a system upgrade,maybe there was a bug and it's resolved.
also, try and explicitly define the souce network and the protocol for the postrouting rules, maybe that'll help.
Offline
Done and done. No effect. The only course i see is to compile a vanilla kernel from kernel.org as the default one in abs is patched quite heavily. I know it's a long shot but that's the only reasonable explanation i can come up with.
Offline