Jesse Cantara wrote:
Hello,
I am trying to figure out a problem I'm having using CentOS on a machine as a router. The short story is: any traffic routed through the router seems to get disconnected at random occasionally.
The hardware setup is: I have two switches, the router sits between them, the webserver on the LAN switch. The machine I'm using for the router is a Dell 860 1U rackmount with two NICs, one NIC on the internet, one NIC on the LAN.
The routing setup is: I'm using IPTABLES for routing, with the following command: iptables -t nat -A PREROUTING -p tcp -m tcp -i eth1 --dport 6680 -j DNAT --to 192.168.1.10:80 Basically, I'm forwarding port 6680 on to the webserver (.10) on the LAN.
What I have tested so far: If I'm at the router, I can download files from the webserver just fine, so the webserver setup and physical connection is OK. If I'm at the router, I can download files from the internet just fine, so the physical connection to the outside is OK as well. If I'm on the outside of the router (on the internet) I can download files directly from the router just fine.
The issue is when I try to download a file from the webserver via the router (port 6680). It will work sometimes, but other times it will randomly disconnect me, at random points during the download.
Watching the traffic on a packet-sniffer shows that right before the download fails, my client computer trying to download the file keeps resending "ACK" messages, the router keeps sending the next sequence of packets, and eventually the router sends a bunch of "RST" packets.
There aren't any strange messages in /var/log/messages or dmesg in either the router or the webserver
I need some help diagnosing this problem. Here's some info about the router: CentOS 5 latest kernel 2.6.18-8.1.8.el5 iptables v1.3.5
I've tried testing as much as I can before asking for help, but I'm at the end of what I know to try. Any leads as to where to look to diagnose, or what might cause this would help.
Thanks in advance, -Jesse
CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
Jesse,
What IP address are you using when you try to access the webserver (via port 6680) from the router, the public or the private?
If I read the iptables man page correctly, I would not expect the router to mangle the packets generated locally for the PREROUTING table since the packets are not "really" arriving at the eth1 interface. Maybe the problem is that some packets are getting through at all. What happens if you try to access the webserver from a machine on the LAN, but using the public IP address and port 6680?
Why not use port 80 and the private IP when accessing the webserver from the router, and anywhere else in the LAN, and address the webserver via 6680 when coming in from the internet. If I read your test scenarios correctly, both of those conditions work correctly and I assume that is your intent.
Bob...