Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #1924

Re: Odd Routing behavure

Show all headers | View raw

Finally, a solution!

iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-
pmtu

That did the trick :)



f0o wrote:

> Hi again,
> 
> thanks to #debian from efnet.org they suggested me it might be a MTU
> related problem. Lowering the MTU did solve my issue but a 2nd issue
> remains, why doesnt my kernel refragment the pkgs from eth0 (1500) to ppp0
> (1495) and vise versa...
> 
> And this eventhough I got an exact duplicate
> (software+hardware+config+routing) with etho on 9000 and ppp0 on 1495. And
> no problems on this one! :|
> 
> 
> f0o wrote:
> 
>> Hi,
>> 
>> I recently set up some Debian Wheezy as routers.
>> IPTables are as essential as possible, only containing the
>> MASQUERADE rule in NAT POSTROUTING aswell as the limitation
>> of RELATED/ESTABLISHED in FORWARD for my ppp0 device.
>> 
>> So far so good, ip_forward is enabled and rp_filter is
>> disabled. Furthermore I need arp_ignore and arp_announce on
>> '2'.
>> 
>> Now the fuzzy part:
>> When ever I try to access *some* .com pages (like
>> packetstormsecurity.com [but not
>> www.packetstormsecurity.com], ebay.com [no CSS] and several
>> others) TCPDump doesnt show any data-responce from the
>> servers. I get an ACK from the servers after I sent my
>> headers, but nothing more, it simply waits until Timeout.
>> This however only happens on *nix hosts, Windows can access
>> all sites without problems (!)
>> 
>> Now how can it be, that Windows gets the right responce to
>> its HTTP-GET but if a *nix requests it, the responce never
>> makes it to the ppp0 on the router?
>> 
>> I had this bug for some weeks now and I cant think of any
>> solution...
>> 
>> as simple "curl -v http://www.packetstormsecurity.com/"
>> returns an Apache Redirect (At least a responce) - on same
>> host I tried then "curl -v http://packetstormsecurity.com/"
>> but nothing is returned (apart from the ACK that the server
>> understood my HTTP-GET)
>> 
>> Ideas?
>> 
>> I've no clue what do, I went already through my iptables
>> (thats why they now only consist of 3 rules) and nothing :|
>> 
>> I've had this problem earlier with another router on wheezy
>> but this kinda solved itself... I didnt change anything or
>> updated anything, from one day to another it worked - but
>> not this one... this one is bugging me for weeks... And
>> also rendering half the internet useless...
>> 
>> 
>> Thanks for your time,
>> 
>> f0o
-- 
- f0o

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: Odd Routing behavure f0o <f0o@devilcode.org> - 2013-02-02 14:24 +0100
  Re: Odd Routing behavure f0o <f0o@devilcode.org> - 2013-02-02 15:37 +0100

csiph-web