3 down vote favorite

I have a strange behaviour in my server setup. It looks like that.

client1 <----> (br1/vlan1) Server (br21/vlan21) <---> client2

On the server I have set up DNAT for two ports to another destination.

~> sudo iptables -t nat -nL -v Chain PREROUTING (policy ACCEPT 3631 packets, 220K bytes) pkts bytes target prot opt in out source destination
5332 320K DNAT tcp -- * * multiport dports 5308,21 to:

~> ip r get via dev br1 src

This works for some time from both clients but after an unspecified time only packets from client2 are forwarded any more. The packet counter increases when I try to connect from client1 but there is no NAT any more. Sometimes it started to work again after some hours.

Nothing is blocked in the firewall because all policies are on ACCEPT and no rules where set. The conntrack is not full either. I already tried multiple things with rp_filter and so on but this should be no problem in these setup.

when I set br1 to promisc mode it starts working, but I want to understand why the interface doesn't accept the packets without promisc mode.

Hopefully someone has an idea.


Try lowering your MTU size on your clients' interfaces just in case something is dropping fragmented packets. In any case you should run tcpdump/wireshark on both clients and the server and see which one is causing this problem.

  • The packages are not fragmented and as I have written when I set the interface to promisc mode (e.g. by starting tcpdump) it works. So how should I debug the problem when it works as long as I debug that. The drop happens after NAT because the counter of the rule grows but no packets are leaving the outgoing interface afterwards. – Filesearcher Feb 17 '14 at 12:12
  • You can disable promiscuous on tcpdump and check what is different in those packages that go through when it is on. – manjiki Feb 17 '14 at 12:32
  • Nothing different in incoming TCP packages. I can't put in the dump because it's too long. – Filesearcher Feb 17 '14 at 13:28
  • IIRC, bridges need to have promisc mode ON always in order to work properly. If you got one tcpdump with promisc mode off and one with on, you should be able to see differences. – manjiki Feb 17 '14 at 13:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.