0

I’m struggling with an issue on one Ubuntu server 18.04.1 LTS.

This server has IP 192.168.0.2 on network 192.168.0.0/24. This server is pingable (and accessible) from all devices from that network.

Problem is that this specific server is not pingable from another network, to be more specific from network 192.168.20.0/24. I’m sure, that firewall between networks is configured correctly, because this specific server is the only device which is not accessible from another network.

When I execute tcpdump -i ens160 icmp on the problematic server, I get this result:

16:57:31.354942 IP 192.168.0.42 > 192.168.0.2: ICMP echo request, id 1, seq 58385, length 40
16:57:31.354974 IP 192.168.0.2 > 192.168.0.42: ICMP echo reply, id 1, seq 58385, length 40
16:57:32.098138 IP 192.168.20.23 > 192.168.0.2: ICMP echo request, id 29304, seq 110, length 64
16:57:33.122226 IP 192.168.20.23 > 192.168.0.2: ICMP echo request, id 29304, seq 111, length 64

So, my server receives ping correctly, but something is blocking the request.

I was suspecting iptables and because I didn’t want to make the server completely inaccessible, I installed test ubuntu server with the same version. I exported iptables configuration from the production server and imported it to the test server and I also made it persistent. Test server is pingable from the other network without any problem.

iptables on the server:

# Generated by iptables-save v1.6.1 on Sun Feb  9 17:59:25 2020
*nat
:PREROUTING ACCEPT [236414:19370664]
:INPUT ACCEPT [235269:19281969]
:OUTPUT ACCEPT [185319:11120732]
:POSTROUTING ACCEPT [186881:11216972]
:DOCKER - [0:0]
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A POSTROUTING -s 192.168.64.0/20 ! -o br-9efbb7300706 -j MASQUERADE
-A POSTROUTING -s 172.18.0.0/16 ! -o br-2826a2c517bd -j MASQUERADE
-A POSTROUTING -s 192.168.32.0/20 ! -o br-25700b061906 -j MASQUERADE
-A POSTROUTING -s 192.168.16.0/20 ! -o br-9f4b71ba3f45 -j MASQUERADE
-A POSTROUTING -s 192.168.32.2/32 -d 192.168.32.2/32 -p tcp -m tcp --dport 5432 -j MASQUERADE
-A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 8080 -j MASQUERADE
-A POSTROUTING -s 172.18.0.2/32 -d 172.18.0.2/32 -p tcp -m tcp --dport 5500 -j MASQUERADE
-A POSTROUTING -s 172.18.0.2/32 -d 172.18.0.2/32 -p tcp -m tcp --dport 1521 -j MASQUERADE
-A POSTROUTING -s 192.168.64.2/32 -d 192.168.64.2/32 -p tcp -m tcp --dport 8091 -j MASQUERADE
-A POSTROUTING -s 192.168.64.2/32 -d 192.168.64.2/32 -p tcp -m tcp --dport 8090 -j MASQUERADE
-A DOCKER -i docker0 -j RETURN
-A DOCKER -i br-9efbb7300706 -j RETURN
-A DOCKER -i br-2826a2c517bd -j RETURN
-A DOCKER -i br-25700b061906 -j RETURN
-A DOCKER -i br-9f4b71ba3f45 -j RETURN
-A DOCKER ! -i br-25700b061906 -p tcp -m tcp --dport 5432 -j DNAT --to-destination 192.168.32.2:5432
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 172.17.0.2:8080
-A DOCKER ! -i br-2826a2c517bd -p tcp -m tcp --dport 41001 -j DNAT --to-destination 172.18.0.2:5500
-A DOCKER ! -i br-2826a2c517bd -p tcp -m tcp --dport 41000 -j DNAT --to-destination 172.18.0.2:1521
-A DOCKER ! -i br-9efbb7300706 -p tcp -m tcp --dport 8091 -j DNAT --to-destination 192.168.64.2:8091
-A DOCKER ! -i br-9efbb7300706 -p tcp -m tcp --dport 8090 -j DNAT --to-destination 192.168.64.2:8090
COMMIT
# Completed on Sun Feb  9 17:59:25 2020
# Generated by iptables-save v1.6.1 on Sun Feb  9 17:59:25 2020
*filter
:INPUT ACCEPT [8512756:1759431429]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [8137996:2934693615]
:DOCKER - [0:0]
:DOCKER-ISOLATION-STAGE-1 - [0:0]
:DOCKER-ISOLATION-STAGE-2 - [0:0]
:DOCKER-USER - [0:0]
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -o br-9efbb7300706 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-9efbb7300706 -j DOCKER
-A FORWARD -i br-9efbb7300706 ! -o br-9efbb7300706 -j ACCEPT
-A FORWARD -i br-9efbb7300706 -o br-9efbb7300706 -j ACCEPT
-A FORWARD -o br-2826a2c517bd -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-2826a2c517bd -j DOCKER
-A FORWARD -i br-2826a2c517bd ! -o br-2826a2c517bd -j ACCEPT
-A FORWARD -i br-2826a2c517bd -o br-2826a2c517bd -j ACCEPT
-A FORWARD -o br-25700b061906 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-25700b061906 -j DOCKER
-A FORWARD -i br-25700b061906 ! -o br-25700b061906 -j ACCEPT
-A FORWARD -i br-25700b061906 -o br-25700b061906 -j ACCEPT
-A FORWARD -o br-9f4b71ba3f45 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-9f4b71ba3f45 -j DOCKER
-A FORWARD -i br-9f4b71ba3f45 ! -o br-9f4b71ba3f45 -j ACCEPT
-A FORWARD -i br-9f4b71ba3f45 -o br-9f4b71ba3f45 -j ACCEPT
-A DOCKER -d 192.168.32.2/32 ! -i br-25700b061906 -o br-25700b061906 -p tcp -m tcp --dport 5432 -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8080 -j ACCEPT
-A DOCKER -d 172.18.0.2/32 ! -i br-2826a2c517bd -o br-2826a2c517bd -p tcp -m tcp --dport 5500 -j ACCEPT
-A DOCKER -d 172.18.0.2/32 ! -i br-2826a2c517bd -o br-2826a2c517bd -p tcp -m tcp --dport 1521 -j ACCEPT
-A DOCKER -d 192.168.64.2/32 ! -i br-9efbb7300706 -o br-9efbb7300706 -p tcp -m tcp --dport 8091 -j ACCEPT
-A DOCKER -d 192.168.64.2/32 ! -i br-9efbb7300706 -o br-9efbb7300706 -p tcp -m tcp --dport 8090 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i br-9efbb7300706 ! -o br-9efbb7300706 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i br-2826a2c517bd ! -o br-2826a2c517bd -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i br-25700b061906 ! -o br-25700b061906 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i br-9f4b71ba3f45 ! -o br-9f4b71ba3f45 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o br-9efbb7300706 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o br-2826a2c517bd -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o br-25700b061906 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o br-9f4b71ba3f45 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN
COMMIT
# Completed on Sun Feb  9 17:59:25 2020

Do you have any idea, what could be wrong?

Thank you very much for your advice!

  • You will have to describe your network in more detail. You mention network interface ens160 but your rule set seems to be based on a bunch of interface names, not including ens160. They look, perhaps, like bridged interfaces. Anyway and at least for me, not enough information. However, your use of tcpdump is a great way to debug. Also by showing the packet counters you might be able to determine the iptables rule set traverse route to help debugging. – Doug Smythies Feb 9 at 17:45
  • Use sudo iptables -v -x -n -L and sudo iptables -t nat -v -x -n -L (preferred by me) or sudo iptables-save -c and observe as you run your ping in another terminal. – Doug Smythies Feb 9 at 17:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.