Internet connectivity through my 12.04 LTS shorewall box is spotty at best. Ping works both locally and to the internet with no dropped packets (from both the box itself and internal LAN). HTTP connections work great through squid, but when I don't use squid they are slow and spotty. SSH is also slow and sometimes connecting can be difficult. HTTPS and email don't work at all.
This box is replacing an 11.04 box with the same setup that worked fine. It's a fresh install of 12.04 LTS on new hardware.
Network config:
% ifconfig
eth0 Link encap:Ethernet HWaddr bc:5f:f4:47:99:24
inet addr:X.X.X.X Bcast:255.255.255.255 Mask:255.255.254.0
UP BROADCAST RUNNING MULTICAST MTU:576 Metric:1
RX packets:36215 errors:2882 dropped:0 overruns:0 frame:2882
TX packets:6652 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:2983691 (2.9 MB) TX bytes:660681 (660.6 KB)
Interrupt:16
eth1 Link encap:Ethernet HWaddr bc:5f:f4:47:99:22
inet addr:10.0.0.1 Bcast:10.0.0.255 Mask:255.255.255.0
inet6 addr: fe80::be5f:f4ff:fe47:9922/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:5875 errors:0 dropped:9 overruns:0 frame:0
TX packets:4424 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:661913 (661.9 KB) TX bytes:762000 (762.0 KB)
Interrupt:16
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:18 errors:0 dropped:0 overruns:0 frame:0
TX packets:18 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1284 (1.2 KB) TX bytes:1284 (1.2 KB)
I don't think it's a routing issue:
% route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default X.X.X.X 0.0.0.0 UG 100 0 0 eth0
10.0.0.0 * 255.255.255.0 U 0 0 0 eth1
X.X.X.0 * 255.255.254.0 U 0 0 0 eth0
I've enabled IP forwarding:
% sudo sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
I've tried with rp_filter on and off with the same results.
I've tried specifically adding a rule to shorewall to allow traffic through on 80 and 443, but it didn't fix it (and shouldn't be necessary with the given policy).
Shorewall config is as follows:
% grep -v ^# /etc/shorewall/interfaces
net eth0 detect dhcp
loc eth1 detect dhcp
% grep -v ^# /etc/shorewall/zones
fw firewall
net ipv4
loc ipv4
% grep -v ^# /etc/shorewall/rules
SECTION NEW
Ping(ACCEPT) fw loc
% grep -v ^# /etc/shorewall/policy
fw fw ACCEPT info
fw net ACCEPT info
fw all REJECT warning
loc fw ACCEPT info
loc net ACCEPT info
net fw REJECT notice
net loc DROP error
all all REJECT info
% grep -v ^# /etc/shorewall/masq
eth0 10.0.0.0/24
Relevant iptables:
% sudo iptables -L
...
Chain net2loc (1 references)
target prot opt source destination
dynamic all -- anywhere anywhere ctstate INVALID,NEW
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
Drop all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level error prefix "Shorewall:net2loc:DROP:"
DROP all -- anywhere anywhere
...
% sudo iptables -t nat -L -v -n
...
Chain POSTROUTING (policy ACCEPT 116 packets, 8749 bytes)
pkts bytes target prot opt in out source destination
189 12557 eth0_masq all -- * eth0 0.0.0.0/0 0.0.0.0/0
Chain eth0_masq (1 references)
pkts bytes target prot opt in out source destination
73 3808 MASQUERADE all -- * * 10.0.0.0/24 0.0.0.0/0
Everything looks okay to my eyes.
I think it's a connection tracking issue, but I'm not sure how to go about diagnosing it, much less fix it. Any help is greatly appreciated.