[CentOS] CentOS based router dropping connections
bob.chiodini at nasa.gov
Fri Jul 20 16:23:34 UTC 2007
Jesse Cantara wrote:
> I am trying to figure out a problem I'm having using CentOS on a
> machine as a router. The short story is: any traffic routed through
> the router seems to get disconnected at random occasionally.
> The hardware setup is:
> I have two switches, the router sits between them, the webserver on
> the LAN switch.
> The machine I'm using for the router is a Dell 860 1U rackmount with
> two NICs, one NIC on the internet, one NIC on the LAN.
> The routing setup is:
> I'm using IPTABLES for routing, with the following command:
> iptables -t nat -A PREROUTING -p tcp -m tcp -i eth1 --dport 6680 -j
> DNAT --to 192.168.1.10:80
> Basically, I'm forwarding port 6680 on to the webserver (.10) on the LAN.
> What I have tested so far:
> If I'm at the router, I can download files from the webserver just
> fine, so the webserver setup and physical connection is OK.
> If I'm at the router, I can download files from the internet just
> fine, so the physical connection to the outside is OK as well.
> If I'm on the outside of the router (on the internet) I can download
> files directly from the router just fine.
> The issue is when I try to download a file from the webserver via the
> router (port 6680). It will work sometimes, but other times it will
> randomly disconnect me, at random points during the download.
> Watching the traffic on a packet-sniffer shows that right before the
> download fails, my client computer trying to download the file keeps
> resending "ACK" messages, the router keeps sending the next sequence
> of packets, and eventually the router sends a bunch of "RST" packets.
> There aren't any strange messages in /var/log/messages or dmesg in
> either the router or the webserver
> I need some help diagnosing this problem. Here's some info about the
> CentOS 5
> latest kernel 2.6.18-8.1.8.el5
> iptables v1.3.5
> I've tried testing as much as I can before asking for help, but I'm at
> the end of what I know to try. Any leads as to where to look to
> diagnose, or what might cause this would help.
> Thanks in advance,
> CentOS mailing list
> CentOS at centos.org
What IP address are you using when you try to access the webserver (via
port 6680) from the router, the public or the private?
If I read the iptables man page correctly, I would not expect the router
to mangle the packets generated locally for the PREROUTING table since
the packets are not "really" arriving at the eth1 interface. Maybe the
problem is that some packets are getting through at all. What happens
if you try to access the webserver from a machine on the LAN, but using
the public IP address and port 6680?
Why not use port 80 and the private IP when accessing the webserver from
the router, and anywhere else in the LAN, and address the webserver via
6680 when coming in from the internet. If I read your test scenarios
correctly, both of those conditions work correctly and I assume that is
More information about the CentOS