Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.os.linux.networking > #1923 > unrolled thread
| Started by | f0o <f0o@devilcode.org> |
|---|---|
| First post | 2013-02-02 14:24 +0100 |
| Last post | 2013-02-02 15:37 +0100 |
| Articles | 2 — 1 participant |
Back to article view | Back to comp.os.linux.networking
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
Re: Odd Routing behavure f0o <f0o@devilcode.org> - 2013-02-02 14:24 +0100
Re: Odd Routing behavure f0o <f0o@devilcode.org> - 2013-02-02 15:37 +0100
| From | f0o <f0o@devilcode.org> |
|---|---|
| Date | 2013-02-02 14:24 +0100 |
| Subject | Re: Odd Routing behavure |
| Message-ID | <510d13ff$1@news.synserver.de> |
Hi again, thanks to #debian from efnet.org they suggested me it might be a MTU related problem. Lowering the MTU did solve my issue but a 2nd issue remains, why doesnt my kernel refragment the pkgs from eth0 (1500) to ppp0 (1495) and vise versa... And this eventhough I got an exact duplicate (software+hardware+config+routing) with etho on 9000 and ppp0 on 1495. And no problems on this one! :| f0o wrote: > Hi, > > I recently set up some Debian Wheezy as routers. > IPTables are as essential as possible, only containing the > MASQUERADE rule in NAT POSTROUTING aswell as the limitation > of RELATED/ESTABLISHED in FORWARD for my ppp0 device. > > So far so good, ip_forward is enabled and rp_filter is > disabled. Furthermore I need arp_ignore and arp_announce on > '2'. > > Now the fuzzy part: > When ever I try to access *some* .com pages (like > packetstormsecurity.com [but not > www.packetstormsecurity.com], ebay.com [no CSS] and several > others) TCPDump doesnt show any data-responce from the > servers. I get an ACK from the servers after I sent my > headers, but nothing more, it simply waits until Timeout. > This however only happens on *nix hosts, Windows can access > all sites without problems (!) > > Now how can it be, that Windows gets the right responce to > its HTTP-GET but if a *nix requests it, the responce never > makes it to the ppp0 on the router? > > I had this bug for some weeks now and I cant think of any > solution... > > as simple "curl -v http://www.packetstormsecurity.com/" > returns an Apache Redirect (At least a responce) - on same > host I tried then "curl -v http://packetstormsecurity.com/" > but nothing is returned (apart from the ACK that the server > understood my HTTP-GET) > > Ideas? > > I've no clue what do, I went already through my iptables > (thats why they now only consist of 3 rules) and nothing :| > > I've had this problem earlier with another router on wheezy > but this kinda solved itself... I didnt change anything or > updated anything, from one day to another it worked - but > not this one... this one is bugging me for weeks... And > also rendering half the internet useless... > > > Thanks for your time, > > f0o -- - f0o
[toc] | [next] | [standalone]
| From | f0o <f0o@devilcode.org> |
|---|---|
| Date | 2013-02-02 15:37 +0100 |
| Message-ID | <510d24ff@news.synserver.de> |
| In reply to | #1923 |
Finally, a solution! iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to- pmtu That did the trick :) f0o wrote: > Hi again, > > thanks to #debian from efnet.org they suggested me it might be a MTU > related problem. Lowering the MTU did solve my issue but a 2nd issue > remains, why doesnt my kernel refragment the pkgs from eth0 (1500) to ppp0 > (1495) and vise versa... > > And this eventhough I got an exact duplicate > (software+hardware+config+routing) with etho on 9000 and ppp0 on 1495. And > no problems on this one! :| > > > f0o wrote: > >> Hi, >> >> I recently set up some Debian Wheezy as routers. >> IPTables are as essential as possible, only containing the >> MASQUERADE rule in NAT POSTROUTING aswell as the limitation >> of RELATED/ESTABLISHED in FORWARD for my ppp0 device. >> >> So far so good, ip_forward is enabled and rp_filter is >> disabled. Furthermore I need arp_ignore and arp_announce on >> '2'. >> >> Now the fuzzy part: >> When ever I try to access *some* .com pages (like >> packetstormsecurity.com [but not >> www.packetstormsecurity.com], ebay.com [no CSS] and several >> others) TCPDump doesnt show any data-responce from the >> servers. I get an ACK from the servers after I sent my >> headers, but nothing more, it simply waits until Timeout. >> This however only happens on *nix hosts, Windows can access >> all sites without problems (!) >> >> Now how can it be, that Windows gets the right responce to >> its HTTP-GET but if a *nix requests it, the responce never >> makes it to the ppp0 on the router? >> >> I had this bug for some weeks now and I cant think of any >> solution... >> >> as simple "curl -v http://www.packetstormsecurity.com/" >> returns an Apache Redirect (At least a responce) - on same >> host I tried then "curl -v http://packetstormsecurity.com/" >> but nothing is returned (apart from the ACK that the server >> understood my HTTP-GET) >> >> Ideas? >> >> I've no clue what do, I went already through my iptables >> (thats why they now only consist of 3 rules) and nothing :| >> >> I've had this problem earlier with another router on wheezy >> but this kinda solved itself... I didnt change anything or >> updated anything, from one day to another it worked - but >> not this one... this one is bugging me for weeks... And >> also rendering half the internet useless... >> >> >> Thanks for your time, >> >> f0o -- - f0o
[toc] | [prev] | [standalone]
Back to top | Article view | comp.os.linux.networking
csiph-web