cannot ping specific interface from router: (sendmsg: Operation not permitted)

Question

I have router that I built running Arch Linux and I have a strange problem that might point to a misconfiguration. Here is my setup:

LAN interface: intern1
WAN interface: extern1
LAN address: 192.168.11.11/24
WAN address: DHCP

I can ping anything on the WAN interface without error:

> ping 8.8.8.8

PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=117 time=2.78 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=117 time=2.60 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=117 time=2.87 ms

However, I can't ping another address on the LAN (192.168.11.39 is a server on the LAN):

> ping 192.168.11.39

PING 192.168.11.39 (192.168.11.39) 56(84) bytes of data.
From 192.168.11.11 icmp_seq=1 Destination Host Unreachable
ping: sendmsg: Operation not permitted
From 192.168.11.11 icmp_seq=2 Destination Host Unreachable
ping: sendmsg: Operation not permitted
From 192.168.11.11 icmp_seq=3 Destination Host Unreachable
ping: sendmsg: Operation not permitted

Other questions like this seem to point to a firewall issue. I tried changing all the chains in the filter table to ACCEPT default policy with no effect. I should add that other than this ping issue the router works; things on the LAN can access the WAN and any device on the LAN and ping another device on the LAN.

For the record, I found this issue because I am trying to set up OpenVPN on this router and I can't ping anything on the LAN from any VPN clients. I thought this might be related. Everything here was done without the VPN enabled to eliminate that possibly confounding variable.

Does anyone know what could be causing this?

Other possibly important information

Routing table:

> ip route

default via 45.17.160.1 dev extern1 proto dhcp src 45.17.163.240 metric 1024 
45.17.160.0/22 dev extern1 proto kernel scope link src 45.17.163.240 
45.17.160.1 dev extern1 proto dhcp scope link src 45.17.163.240 metric 1024 
192.168.11.0/24 dev intern1 proto kernel scope link src 192.168.11.11

iptables rules (minimal example):

*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:net_dnat - [0:0]

# potentially DNAT all incoming packets
-A PREROUTING -i extern1 -j net_dnat

# make all LAN-WAN traffic appear as if it came from this router
-A POSTROUTING -s 192.168.11.0/24 -o extern1 -j MASQUERADE

# make all VPN traffic appear as if it came from this router
-A POSTROUTING -s 10.8.0.0/24 -o intern1 -j MASQUERADE
-A POSTROUTING -s 10.8.0.0/24 -o extern1 -j MASQUERADE

# DNAT table for port forwards on LAN
-A net_dnat -m comment --comment "SSH" -p tcp -m tcp --dport 39022 -j DNAT --to-destination 192.168.11.39:39022
-A net_dnat -m comment --comment "HTTP" -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.11.39:80
-A net_dnat -m comment --comment "HTTPS" -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.11.39:443
-A net_dnat -m comment --comment "IMAP" -p tcp -m tcp --dport 143 -j DNAT --to-destination 192.168.11.39:143
-A net_dnat -m comment --comment "IMAPS" -p tcp -m tcp --dport 993 -j DNAT --to-destination 192.168.11.39:993
-A net_dnat -m comment --comment "WOL" -p udp -m udp --dport 39009 -j DNAT --to-destination 192.168.11.254:39009
COMMIT

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT

systemd-networkd configuration:

> cat /etc/systemd/network/intern1.network

[Match]
Name=intern1

[Network]
Address=192.168.11.11/24
IPForward=ipv4

> cat /etc/systemd/network/intern1.network

[Match]
Name=extern1

[Network]
DHCP=ipv4
IPForward=ipv4

Edit 1

routing policy:

> ip rule ls
0:     from all lookup local
32766: from all lookup main
32767: from all lookup default

ARP entry for 192.168.11.39:

> ip n ls 192.168.11.39
192.168.11.39 dev intern1 lladdr f8:32:e4:9b:b9:55 REACHABLE

Route lookup for 192.168.11.39:

> ip route get 192.168.11.39
192.168.11.39 dev intern1 src 192.168.11.11 uid 1000 
    cache

Edit 2

full filter table:

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:localhost-LAN - [0:0]
:localhost-WAN - [0:0]
:localhost-VPN - [0:0]
:VPN-localhost - [0:0]
:LAN-localhost - [0:0]
:WAN-localhost - [0:0]
:LAN-VPN - [0:0]
:LAN-WAN - [0:0]
:WAN-LAN - [0:0]
:WAN-VPN - [0:0]
:LAN-forward - [0:0]
:WAN-forward - [0:0]
:VPN-forward - [0:0]
:reject - [0:0]

-A INPUT -i intern1 -j LAN-localhost
-A INPUT -i extern1 -j WAN-localhost
-A INPUT -i tun0 -j VPN-localhost
-A INPUT -i lo -j ACCEPT
-A INPUT -g reject

-A FORWARD -i extern1 -j WAN-forward
-A FORWARD -i intern1 -j LAN-forward
-A FORWARD -i tun0 -j VPN-forward
-A FORWARD -g reject

-A OUTPUT -o extern1 -j localhost-WAN
-A OUTPUT -o intern1 -j localhost-LAN
-A OUTPUT -o tun0 -j localhost-VPN
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -g reject

-A LAN-forward -o extern1 -j ACCEPT
-A LAN-forward -o tun0 -j LAN-VPN

-A WAN-forward -o intern1 -j WAN-LAN
-A WAN-forward -o tun0 -j WAN-VPN

-A VPN-forward -o intern1 -j ACCEPT
-A VPN-forward -o extern1 -j ACCEPT

-A WAN-LAN -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A WAN-LAN -m comment --comment "SSH" -d 192.168.11.39/32 -p tcp -m tcp --dport 39022 -m conntrack --ctorigdstport 39022 -j ACCEPT
-A WAN-LAN -m comment --comment "HTTP" -d 192.168.11.39/32 -p tcp -m tcp --dport 80 -m conntrack --ctorigdstport 80 -j ACCEPT
-A WAN-LAN -m comment --comment "HTTPS" -d 192.168.11.39/32 -p tcp -m tcp --dport 443 -m conntrack --ctorigdstport 443 -j ACCEPT
-A WAN-LAN -m comment --comment "IMAP" -d 192.168.11.39/32 -p tcp -m tcp --dport 143 -m conntrack --ctorigdstport 143 -j ACCEPT
-A WAN-LAN -m comment --comment "IMAPS" -d 192.168.11.39/32 -p tcp -m tcp --dport 993 -m conntrack --ctorigdstport 993 -j ACCEPT
-A WAN-LAN -m comment --comment "WOL" -d 192.168.11.254/32 -p udp -m udp --dport 39009 -m conntrack --ctorigdstport 39009 -j ACCEPT
-A WAN-LAN -j DROP

-A localhost-LAN -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A localhost-LAN -m comment --comment "Local DHCP" -p udp -m udp --dport 67:68 -j ACCEPT
-A localhost-LAN -m comment --comment "Local SSH" -d 192.168.11.39/32 -p tcp -m tcp --dport 39022 -m conntrack --ctorigdstport 39022 -j ACCEPT
-A localhost-LAN -g reject

-A LAN-VPN -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A LAN-VPN -j DROP

-A WAN-VPN -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A WAN-VPN -j DROP

-A localhost-VPN -j ACCEPT

-A localhost-WAN -j ACCEPT

-A LAN-localhost -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A LAN-localhost -m comment --comment "LAN OpenVPN" -p udp --dport 21194 -j ACCEPT
-A LAN-localhost -m comment --comment "LAN DHCP" -p udp -m udp --dport 67:68 -j ACCEPT
-A LAN-localhost -m comment --comment "LAN SSH" -p tcp --dport 29022 -j ACCEPT
-A LAN-localhost -m comment --comment "LAN DNS (zone transfer)" -p tcp --dport 53 -j ACCEPT
-A LAN-localhost -m comment --comment "LAN DNS" -p udp -m udp --dport 53 -j ACCEPT
-A LAN-localhost -m comment --comment "LAN Ping" -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A LAN-localhost -g reject

-A WAN-localhost -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A WAN-localhost -m comment --comment "WAN OpenVPN" -p udp --dport 21194 -j ACCEPT
-A WAN-localhost -m comment --comment "WAN SSH" -p tcp --dport 29022 -j ACCEPT
-A WAN-localhost -m comment --comment "WAN Ping" -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A WAN-localhost -j DROP

-A VPN-localhost -j ACCEPT

-A reject -m addrtype --src-type BROADCAST -j DROP
-A reject -s 224.0.0.0/4 -j DROP
-A reject -p igmp -j DROP
-A reject -p tcp -j REJECT --reject-with tcp-reset
-A reject -p udp -j REJECT --reject-with icmp-port-unreachable
-A reject -p icmp -j REJECT --reject-with icmp-host-unreachable
-A reject -j REJECT --reject-with icmp-host-prohibited
COMMIT

Please show output of commands: ip rule ls and ip route get 192.168.11.39 and ip n ls to 192.168.11.39. — Anton Danilov, Commented Oct 2, 2020 at 7:24
Hm. Very strange. Have you provided the full output of iptables-save? — Anton Danilov, Commented Oct 2, 2020 at 21:16
@AntonDanilov nope, I excluded everything except the INPUT/OUTPUT/FORWARD chains in the filter table since I thought using 'ACCEPT' as the default policy would nullify everything else and therefore I wouldn't need to include the the gory/possibly irrelevant details of the filter table in the OP. I figured out this was the wrong assumption, which led to the solution. Thanks :) — petrucci4prez, Commented Oct 4, 2020 at 17:57

petrucci4prez · Accepted Answer · 2020-10-04 18:02:11Z

Solution

It actually was a firewall problem. I incorrectly assumed that using ACCEPT as default policy on the 'INPUT/OUTPUT/FORWARD' chains would nullify all the remaining chains in the filter table, which made me think this wasn't a firewall issue in the first place

In reality the default policy is applied last when nothing matches, but in this case the 'localhost-LAN' chain was intercepting the outgoing ping and applying 'reject'. Adding this before the 'reject' target fixed the issue:

-A localhost-LAN -m comment --comment "LAN Ping" -p icmp -m icmp --icmp-type 8 -j ACCEPT

Outgoing ping to LAN now works :)

Stack Exchange Network

cannot ping specific interface from router: (sendmsg: Operation not permitted)

Other possibly important information

Edit 1

Edit 2

1 Answer 1

Solution

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
iptables
router
ping
arch-linux
.

Hot Network Questions

cannot ping specific interface from router: (sendmsg: Operation not permitted)

Other possibly important information

Edit 1

Edit 2

1 Answer 1

Solution

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged iptablesrouterpingarch-linux.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
iptables
router
ping
arch-linux
.