Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Internet connectivity through my 12.04 LTS shorewall box is spotty at best. Ping works both locally and to the internet with no dropped packets (from both the box itself and internal LAN). HTTP connections work great through squid, but when I don't use squid they are slow and spotty. SSH is also slow and sometimes connecting can be difficult. HTTPS and email don't work at all.

This box is replacing an 11.04 box with the same setup that worked fine. It's a fresh install of 12.04 LTS on new hardware.

Network config:

% ifconfig
eth0      Link encap:Ethernet  HWaddr bc:5f:f4:47:99:24  
          inet addr:X.X.X.X  Bcast:255.255.255.255  Mask:255.255.254.0
          UP BROADCAST RUNNING MULTICAST  MTU:576  Metric:1
          RX packets:36215 errors:2882 dropped:0 overruns:0 frame:2882
          TX packets:6652 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:2983691 (2.9 MB)  TX bytes:660681 (660.6 KB)
          Interrupt:16 

eth1      Link encap:Ethernet  HWaddr bc:5f:f4:47:99:22  
          inet addr:10.0.0.1  Bcast:10.0.0.255  Mask:255.255.255.0
          inet6 addr: fe80::be5f:f4ff:fe47:9922/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:5875 errors:0 dropped:9 overruns:0 frame:0
          TX packets:4424 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:661913 (661.9 KB)  TX bytes:762000 (762.0 KB)
          Interrupt:16 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:18 errors:0 dropped:0 overruns:0 frame:0
          TX packets:18 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1284 (1.2 KB)  TX bytes:1284 (1.2 KB)

I don't think it's a routing issue:

% route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         X.X.X.X         0.0.0.0         UG    100    0        0 eth0
10.0.0.0        *               255.255.255.0   U     0      0        0 eth1
X.X.X.0         *               255.255.254.0   U     0      0        0 eth0

I've enabled IP forwarding:

% sudo sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1

I've tried with rp_filter on and off with the same results.

I've tried specifically adding a rule to shorewall to allow traffic through on 80 and 443, but it didn't fix it (and shouldn't be necessary with the given policy).

Shorewall config is as follows:

% grep -v ^# /etc/shorewall/interfaces
net eth0  detect  dhcp
loc eth1  detect  dhcp

% grep -v ^# /etc/shorewall/zones
fw  firewall
net ipv4
loc ipv4

% grep -v ^# /etc/shorewall/rules
SECTION NEW
Ping(ACCEPT)  fw  loc

% grep -v ^# /etc/shorewall/policy

fw  fw  ACCEPT  info
fw  net ACCEPT  info
fw  all REJECT  warning

loc fw  ACCEPT  info
loc net ACCEPT  info

net fw  REJECT  notice
net loc DROP  error

all all REJECT  info

% grep -v ^# /etc/shorewall/masq
eth0  10.0.0.0/24

Relevant iptables:

% sudo iptables -L
...

Chain net2loc (1 references)
target     prot opt source               destination         
dynamic    all  --  anywhere             anywhere             ctstate INVALID,NEW
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
Drop       all  --  anywhere             anywhere            
LOG        all  --  anywhere             anywhere             LOG level error prefix "Shorewall:net2loc:DROP:"
DROP       all  --  anywhere             anywhere            
...

% sudo iptables -t nat -L -v -n
...

Chain POSTROUTING (policy ACCEPT 116 packets, 8749 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  189 12557 eth0_masq  all  --  *      eth0    0.0.0.0/0            0.0.0.0/0           

Chain eth0_masq (1 references)
 pkts bytes target     prot opt in     out     source               destination         
   73  3808 MASQUERADE  all  --  *      *       10.0.0.0/24          0.0.0.0/0 

Everything looks okay to my eyes.

I think it's a connection tracking issue, but I'm not sure how to go about diagnosing it, much less fix it. Any help is greatly appreciated.

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.