Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm new to this site and I want to apologize in advance for any mistakes, dumb questions, etc. (if any).
I have a networking issue and I hope someone has ideas how to solve it. I'm almost sure it's a simple one.

First of all, let's introduce my network configuration/geometry:

  (        )             SRV                 PC-A                 PC-B
 (          )     ╔════════════╤══╗    ╔═══╤═══════════╗    ╔════════════╤══╗
(  INTERNET  )═══>║│  ║    ║   │║═══>║│  ║
 (          )     ╟────────────┘  ║    ║   └───────────╢    ╟────────────┘  ║
  (        )      ║               ║    ║               ║    ╚═══════════════╝
    ------        ║   ┌───────────╢    ╟────────────┐  ║ 
                  ║   │║═══>║│  ║ 
                  ╚═══╧═══════════╝    ╚════════════╧══╝

SRV and PC-A run on Windows XP Pro SP2. They both have an identical software package which do firewalling, NAT, port forwarding and rewriting.

PC-B runs Arch Linux with no iptables rules, it only uses the hosts.allow and hosts.deny approach. PC-B also has a partition with Windows XP Pro SP2 (fresh install, no other software which interacts with the system, firewall disabled).

# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

PC-A has rules to do port forwarding and rewriting:
- port 3333 => port 3306 @;
- all ICMP =>

Now the behaviour:
Case 1) when PC-B runs Windows
- from PC-B I'm able to ping IPs from internet, IPs from and IPs from networks
- if I launch the MySQL server on PC-B, I can connect to it from SRV (specifying host and port 3333) and also from PC-A (netstat shows an establishd connection from when SRV is connected using port forwarding and rewriting)
- from SRV I can ping PC-B

Case 2) when PC-B runs Arch Linux:
- from PC-B I'm able to ping IPs from internet, IPs from and only the IP, but not other IPs from network
- if I launch the MySQL server on PC-B, I cannot connect to it from SRV (specifying host and port 3333), only from PC-A

While doing all this tests, SRV and PC-A were running without changes or restarts or something like this. They do correctly their job and running Windows on PC-B prove this. I also did packet inspection with Wireshark and the packets are delivered to Linux machine.

Now the question is what is wrong with the Linux machine? Why when running Windows everything works like it should, but when running Linux it doesn't?

My assumption is that something related to routes is missing.
Probably the system doesn't know how to respond to packets with the source IP = (but why it can ping in this case? ).
The routes are:

# ip route show dev eth0  proto kernel  scope link  src
default via dev eth0
share|improve this question
you didnt draw those ascii pictures by hand did you? – The Shurrican Apr 10 '11 at 19:29
I did it by hand :) ... but I only had to print out every character only once and then I "ctrl-c/v"'ed them as I needed. – Art84 Apr 11 '11 at 14:57

Are you able to ssh Did you allow in host.allow? is responsible to/from forward the request from to because as per routes is gateway of your linux box.

share|improve this answer
No, I can't use SSH as well. It seems I can't use any service, be it ssh, mysql, http, ping, or others. Maybe a network monitoring tool (tcpdump? does it intercept packets before ANY other process, firewalls, hosts.allow/deny, etc. ?) could help me to find out if the packets arrive to PC-B. – Art84 Apr 11 '11 at 15:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.