Content-Type: text/plain; charset="ISO-8859-1" From: f0o Date: Sat, 02 Feb 2013 15:37:01 +0100 User-Agent: KNode/4.9.3 Content-Transfer-Encoding: 7Bit Subject: Re: Odd Routing behavure Newsgroups: comp.os.linux.networking References: <510b6fe4$1@news.synserver.de> <510d13ff$1@news.synserver.de> Lines: 75 MIME-Version: 1.0 NNTP-Posting-Host: news.synserver.de Message-ID: <510d24ff@news.synserver.de> X-Trace: news.synserver.de 1359815935 79.192.194.213 (2 Feb 2013 15:38:55 +0100) Organization: synergetic AG X-Complaints-To: abuse@synergetic.ag X-SynServer-News: news.synserver.de Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!us.feeder.erje.net!newsfeed.straub-nv.de!weretis.net!feeder4.news.weretis.net!news1.dtag.de!news.synserver.de!not-for-mail Xref: csiph.com comp.os.linux.networking:1924 Finally, a solution! iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to- pmtu That did the trick :) f0o wrote: > Hi again, > > thanks to #debian from efnet.org they suggested me it might be a MTU > related problem. Lowering the MTU did solve my issue but a 2nd issue > remains, why doesnt my kernel refragment the pkgs from eth0 (1500) to ppp0 > (1495) and vise versa... > > And this eventhough I got an exact duplicate > (software+hardware+config+routing) with etho on 9000 and ppp0 on 1495. And > no problems on this one! :| > > > f0o wrote: > >> Hi, >> >> I recently set up some Debian Wheezy as routers. >> IPTables are as essential as possible, only containing the >> MASQUERADE rule in NAT POSTROUTING aswell as the limitation >> of RELATED/ESTABLISHED in FORWARD for my ppp0 device. >> >> So far so good, ip_forward is enabled and rp_filter is >> disabled. Furthermore I need arp_ignore and arp_announce on >> '2'. >> >> Now the fuzzy part: >> When ever I try to access *some* .com pages (like >> packetstormsecurity.com [but not >> www.packetstormsecurity.com], ebay.com [no CSS] and several >> others) TCPDump doesnt show any data-responce from the >> servers. I get an ACK from the servers after I sent my >> headers, but nothing more, it simply waits until Timeout. >> This however only happens on *nix hosts, Windows can access >> all sites without problems (!) >> >> Now how can it be, that Windows gets the right responce to >> its HTTP-GET but if a *nix requests it, the responce never >> makes it to the ppp0 on the router? >> >> I had this bug for some weeks now and I cant think of any >> solution... >> >> as simple "curl -v http://www.packetstormsecurity.com/" >> returns an Apache Redirect (At least a responce) - on same >> host I tried then "curl -v http://packetstormsecurity.com/" >> but nothing is returned (apart from the ACK that the server >> understood my HTTP-GET) >> >> Ideas? >> >> I've no clue what do, I went already through my iptables >> (thats why they now only consist of 3 rules) and nothing :| >> >> I've had this problem earlier with another router on wheezy >> but this kinda solved itself... I didnt change anything or >> updated anything, from one day to another it worked - but >> not this one... this one is bugging me for weeks... And >> also rendering half the internet useless... >> >> >> Thanks for your time, >> >> f0o -- - f0o