0

I have a home network with a debian server running kernel 3.8 setup as a router, doing DHCP, DNS-caching, samba and Squid. The motherboard is a Gigabyte GA-Z77X-UD5H with two ethernet ports, one Intel and one Atheros. After the upgrade to kernel 3.8 both cards are detected.

I have configured IPTables with the following rules to allow traffic LAN (eth0) -> WAN (eth1)

#!/bin/bash
PATH=/usr/sbin:/sbin:/bin:/usr/bin

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW ! -i eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

iptables -A FORWARD -i eth1 -o eth0 -j REJECT

and for firewall

#!/bin/bash

PATH=/usr/sbin:/sbin:/bin:/usr/bin

iptables -A INPUT -i lo -j ACCEPT

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

my interfaces are configured as:

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug eth1
iface eth1 inet dhcp

auto eth0
iface eth0 inet static
    address 192.168.7.1
    netmask 255.255.255.0

This works fine until everything drops after a random period of time, sometimes 10 minutes, sometimes several hours, depending on the load. When it goes down, I cant reach the internet and the only solution is to restart the server.

Any suggestions on what could be the cause of this, and how to find the cause is appreciated!

2
  • I'd try to narrow it down some more. Can you access any websites via IP instead of hostname? If so, that would point to a DNS issue. Does the same thing happen if you boot into another OS? If so, that indicates a hardware problem.
    – trpt4him
    Apr 11, 2013 at 11:19
  • I have tried pinging various IP-addresses without success, restarting the interface, reloading the module atl1. ip addr shows me that the interface has the expected address. Linux is the only OS i have installed. Information on how to narrow it down further (useful logs etc.) would be appreciated
    – prinsen
    Apr 11, 2013 at 12:12

2 Answers 2

1

iptables -P INPUT DROP

this iptable rule are dropping all package for your server, even request ping. You need some rules to allow some incoming traffic.

for example for accept ping :

-A INPUT -p icmp -j ACCEPT

for open sshd port:

-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT

1

I updated my kernel to 3.8.7 and the problem disappeared.

Not the answer you're looking for? Browse other questions tagged .