Problems with a new ISP and I think its a chains problem?

Problems with a new ISP and I think its a chains problem?

Post by Peter Nun » Thu, 31 Aug 2000 04:00:00



Hi there,
        I am having some real problems with a new IPS.

I manage to get connected OK each time I try and the connection works
like a rocket for about 2 minutes (sometimes longer, sometimes
shorter) and then just stops.

It doesn't close entirely though.  I can still ping, and traceroute
(most of the time).  I can make connections to web pages (althought
they never load), I can get empty header lists from news groups but
(but now when there are any to down load).

I also see the following in messages and am not sure if there is a
relationship.

Any ideas anyone??

Ta

Peter

BTW, this is RH6.2, and I have used the same chains file for another
ISP with no problems.

Aug 28 08:29:30 slowey kernel: Packet log: output REJECT ppp0 PROTO=6
203.134.28.129:61008 203.134.64.67:119 L=48 S=0x00 I=9285 F=
0x4000 T=127 SYN (#35)
Aug 28 08:29:36 slowey kernel: Packet log: output REJECT ppp0 PROTO=6
203.134.28.129:61008 203.134.64.67:119 L=48 S=0x00 I=9302 F=
0x4000 T=127 SYN (#35)
Aug 28 08:30:03 slowey kernel: Packet log: output REJECT ppp0 PROTO=6
203.134.28.129:61013 203.134.65.91:110 L=48 S=0x00 I=9331 F=
0x4000 T=127 SYN (#35)
Aug 28 08:30:06 slowey kernel: Packet log: output REJECT ppp0 PROTO=6
203.134.28.129:61013 203.134.65.91:110 L=48 S=0x00 I=9332 F=
0x4000 T=127 SYN (#35)

Peter Nunn
DownUnder

 
 
 

Problems with a new ISP and I think its a chains problem?

Post by Rick Matthe » Thu, 31 Aug 2000 04:00:00


Well, let's see. I use this site to help me decypher these things:
http://www.robertgraham.com/pubs/firewall-seen.html

And from /etc/protocols we find that PROTO=6 is TCP. So...

Quote:>Aug 28 08:29:30 slowey kernel: Packet log: output REJECT ppp0 PROTO=6
>203.134.28.129:61008 203.134.64.67:119 L=48 S=0x00 I=9285 F=
>0x4000 T=127 SYN (#35)

Here your OUTPUT chain is blocking a packet that you are trying to send
to port 119 at:

Name:    news.iprimus.com.au
Address:  203.134.64.67

Port 119 is Network News Transfer Protocol, carries USENET traffic.

You mentioned that this ipchains script has worked with another ISP. It
may be that your script was hard coded to allow your newsreader to ONLY
connect to your previous news provider. Therefore, when you try to
connect to your new provider (above), ipchains is blocking it.

I resolved that problem in my own ipchains script by allowing
*outgoing* connections to *any* news server:

# NNTP NEWS client (119)
# ----------------------
ipchains -A output -i $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR $UNPRIVPORTS \
         -d $NEWS_SERVER 119 -j ACCEPT

ipchains -A input  -i $EXTERNAL_INTERFACE -p tcp ! -y \
         -s $NEWS_SERVER 119 \
         -d $IPADDR $UNPRIVPORTS -j ACCEPT

Quote:>Aug 28 08:30:03 slowey kernel: Packet log: output REJECT ppp0 PROTO=6
>203.134.28.129:61013 203.134.65.91:110 L=48 S=0x00 I=9331 F=
>0x4000 T=127 SYN (#35)

Here your OUTPUT chain is blocking a packet that you are trying to send
to port 110 at:

Name:    smtpgate2.syd.iprimus.com.au
Address:  203.134.65.91

Port 110 is POP3.

Once again, your script is probably hard coded to allow outgoing pop3
connections *only* to your previous provider.

Since the pop3 connection must initiated from inside, I solved this
problem like the first:

# POP client (110)
# ----------------

ipchains -A output -i $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR $UNPRIVPORTS \
         --destination-port 110 -j ACCEPT

ipchains -A input  -i $EXTERNAL_INTERFACE -p tcp ! -y \
         --source-port 110 \
         -d $IPADDR $UNPRIVPORTS -j ACCEPT

I hope you find this helpful.

--
Thought for the day:
<http://mysite.directlink.net/matthews/smiles/started.htm>

 
 
 

Problems with a new ISP and I think its a chains problem?

Post by John Hovel » Thu, 31 Aug 2000 04:00:00


Peter --

It sounds that way... it looks like those SYN's from high source ports
(61,000+) are rejected packets from your masqueraded connections.

Remember, IPchains is not stateful... you have to allow these packets.
What does your ipchains rulebase look like?

Cheers,
John


> Hi there,
>         I am having some real problems with a new IPS.

> I manage to get connected OK each time I try and the connection works
> like a rocket for about 2 minutes (sometimes longer, sometimes
> shorter) and then just stops.

> It doesn't close entirely though.  I can still ping, and traceroute
> (most of the time).  I can make connections to web pages (althought
> they never load), I can get empty header lists from news groups but
> (but now when there are any to down load).

> I also see the following in messages and am not sure if there is a
> relationship.

> Any ideas anyone??

> Ta

> Peter

> BTW, this is RH6.2, and I have used the same chains file for another
> ISP with no problems.

> Aug 28 08:29:30 slowey kernel: Packet log: output REJECT ppp0 PROTO=6
> 203.134.28.129:61008 203.134.64.67:119 L=48 S=0x00 I=9285 F=
> 0x4000 T=127 SYN (#35)
> Aug 28 08:29:36 slowey kernel: Packet log: output REJECT ppp0 PROTO=6
> 203.134.28.129:61008 203.134.64.67:119 L=48 S=0x00 I=9302 F=
> 0x4000 T=127 SYN (#35)
> Aug 28 08:30:03 slowey kernel: Packet log: output REJECT ppp0 PROTO=6
> 203.134.28.129:61013 203.134.65.91:110 L=48 S=0x00 I=9331 F=
> 0x4000 T=127 SYN (#35)
> Aug 28 08:30:06 slowey kernel: Packet log: output REJECT ppp0 PROTO=6
> 203.134.28.129:61013 203.134.65.91:110 L=48 S=0x00 I=9332 F=
> 0x4000 T=127 SYN (#35)

> Peter Nunn
> DownUnder

 
 
 

Problems with a new ISP and I think its a chains problem?

Post by Jeroe » Thu, 31 Aug 2000 04:00:00



>Aug 28 08:29:30 slowey kernel: Packet log: output REJECT ppp0 PROTO=6
>203.134.28.129:61008 203.134.64.67:119 L=48 S=0x00 I=9285 F=
>0x4000 T=127 SYN (#35)

Your masquraded box is trying to make a connection to your isp's news
and smtp daemons but the packets get blocked on their way out.

--
Jeroen.

 
 
 

1. ppp problem found (I think) solution a new modem?

Haven't been able to get ppp to work, I THINK it may be my modem.  Any ideas
on "enabling" CSN1?

Check out CSN lines of dmesg:

sf0jb56u to root on /dev/ttyp0
reboot by sf0jb56u:
exiting on signal 15
Copyright (c) 1992-1999 FreeBSD Inc.
Copyright (c) 1982, 1986, 1989, 1991, 1993
The Regents of the University of California. All rights reserved.
FreeBSD 3.3-RELEASE #0: Thu Sep 16 23:40:35 GMT 1999

Timecounter "i8254" frequency 1193182 Hz
CPU: i486 DX2 (486-class CPU)
Origin = "GenuineIntel" Id = 0x435 Stepping = 5
Features=0x3<FPU,VME>
real memory = 33554432 (32768K bytes)
config> di zp0
config> di ze0
config> di lnc0
config> di le0
config> di ie0
config> di fe0
config> di ex0
config> di ed0
config> di cs0
config> di wt0
config> di scd0
config> di mcd0
config> di matcdc0
config> di bt0
config> di aha0
config> di adv0
config> en wdc1
config> po wdc1 0x170
config> ir wdc1 15
config> f wdc1 0
config> q
avail memory = 29237248 (28552K bytes)
Preloaded elf kernel "kernel" at 0xc0379000.
Preloaded userconfig_script "/boot/kernel.conf" at 0xc037909c.
Probing for PnP devices:

-----------------------------------------------------------------


[0x00000000]
CSN 1 is disabled.

------------------------------------------------------------------

Probing for devices on the ISA bus:
sc0 on isa
sc0: VGA color <16 virtual consoles, flags=0x0>
atkbdc0 at 0x60-0x6f on motherboard
atkbd0 irq 1 on isa
psm0 not found
sio0 at 0x3f8-0x3ff irq 4 flags 0x10 on isa
sio0: type 16450
sio1 at 0x2f8-0x2ff irq 3 on isa
sio1: type 16450
fdc0 at 0x3f0-0x3f7 irq 6 drq 2 on isa
fd0: 1.44MB 3.5in
wdc0 at 0x1f0-0x1f7 irq 14 on isa
wdc0: unit 0 (wd0): <WDC AC2340H>
wd0: 325MB (666600 sectors), 1010 cyls, 12 heads, 55 S/T, 512 B/S
wdc0: unit 1 (atapi): <E-IDE CD-ROM Max 54X/Ver7.32I>, removable, accel,
dma, iordy
acd0: drive speed 171 - 8250KB/sec, 128KB cache
acd0: supported read types: CD-R, CD-RW, CD-DA, packet track
acd0: Audio: play, 255 volume levels
acd0: Mechanism: ejectable tray
acd0: Medium: no/blank disc inside, unlocked
wdc1 not found at 0x170
ppc0 not found
1 3C5x9 board(s) on ISA found at 0x300
ep0 at 0x300-0x30f irq 10 on isa
ep0: utp[*UTP*] address 00:10:5a:87:e5:7f
vga0 at 0x3b0-0x3df maddr 0xa0000 msize 131072 on isa
npx0 on motherboard
npx0: INT 16 interface
changing root device to wd0s1a

2. PC-NFS On Solaris 8

3. NEW, never before solved (i think), problem

4. Could linux do distribute computing?

5. Networking problem - Works directly after installation fails after reboot no ifconfig or route problems (I think)

6. Windows Setup : great emergency bootdisk!

7. kppp problems: (I think a dns problem)

8. NIC Card at IRQ 216 ???

9. PPP/PAP problems with new ISP

10. transition from isp 'A' to isp 'B' routing problem

11. FreeBSD newbie having ISP connect problems - route problem

12. A Chain here, A Chain There...

13. Matrox Mystique ands X.