Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've set up dead simple NAT: iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o ppp0 -j MASQUERADE

Everything works almost ok. Almost. The problem I've expirienced is some hosts are not reachable by NAT clients, i.e. there's http://code.jquery.com/jquery-1.4.2.min.js - I can download it from server, but in case of NAT client download stalls on connection stage. I thought its FFs fault, but wget has the same issue. I didn't find any logs/messages that can shed some light on this situtation. Any ideas what's going on? Maybe some tricky thing in sysclt is causing this?

P.S. 3/3 client boxes are expiriencing this issue. This is definitely server trouble.

share|improve this question
    
can you post iptables -L -v and iptables -L -v -t nat output? –  Mr Shunz Nov 10 '10 at 11:12
    
paste.pocoo.org/show/288763 –  Daniel Nov 10 '10 at 11:21
    
What result of executing "telnet code.jquery.com 80 " on problem boxes? Also on linux run before attempt and stop after > tcpdump -vv -i etherwan host code.jquery.com –  mmv-ru Nov 10 '10 at 13:48

3 Answers 3

Problem solved: smart switch was dropping packets somewhy. Replaced it and now everything works.

share|improve this answer
    
which make/model was the device? I think i'm having a similar problem and this would confirm it. Cheers –  BoyMars Mar 28 '11 at 7:13

Just before your iptables drops any packets, add a -j LOG, running the command again then check /var/log/messages and you'll probably find you're dropping some incoming related packets.

share|improve this answer
    
there are no DROP rules. none at all. the only rule iptables has is the one i added manually, all other chains and tables got policy=ACCEPT. dmesg and other logs are quiet on this. –  Daniel Nov 10 '10 at 11:19

Doesn't sound like a NAT problem.

Check the output of ifconfig -a on the client machines. Do you see errors or dropped packets on the interface connected to your LAN?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.