Messages in this thread | | | Date | Fri, 28 May 1999 01:14:15 -0400 | From | Dave Cinege <> | Subject | IP Masq code BUG? (Was: Connection reset by peer error's) |
| |
I have found a problem I can respoduce that seems to be related to the IP Masq kernel code.
(Please read my earlier email below so you can understand this)
Procedure: I commented out all IP masq kernel modules, and ipfwadm config lines on both my servers. I *rebooted* both servers.
From my host I traceroute www.netscape.com. It dies at server2. IP Masq is definitely OFF.
From my Solaris machine I telnet into server 2. OK. I then telnet into server 1. *OK*
I run the following on server 2: ipfwadm-wrapper -F -f ipfwadm-wrapper -F -p deny ipfwadm-wrapper -F -a m -S "192.168.0.0"/24 -D 0.0.0.0/0
From my Solaris machine I telnet into server 2. OK. I then telnet into server 1. It fails with "SetSockOpt: Invalid argument"
My guess is: When IP Masq is enable and the machine forwards traffic that is NOT to be masq'ed, the initial packet is truncated. From that point on the data is fine, unless the IP masq timeout is reached. Then once again the truncation will repeat itself on the first packet.
All the above testing is with 2.2.9, but I've seen this problem since at least the 2.0.36pre's.
=================================================================== > > > Ever since 2.0.36pre, I've began seeing "Connection reset by peer" > > errors when I would ssh in to my servers. It evetually got worse > > to where when I first check my POP3 server, I get it. > > > > Can anyone enlighten me?
An important point I forgot to mention (DOH!)....I see this only when bouncing off an internal router.
Linux Server1 208.225.71.1 eth0...internet 192.168.0.1 eth1
Linux Server2 208.225.71.2 eth0 192.168.0.2 eth1 route -host 208.225.71.1 gw 192.168.0.1
Workstation(s) 192.168.0.0 network route default gw 192.168.0.2
In the above all workstation requests for 208.225.71.1 (server 1 eth0) will be bounced off of server 2, since server 2 is their default route. That is where I see the problem. If a workstation requests 208.225.71.2, all is well. If it requests 208.225.71.1, (and gets bounced) depending on the services and client OS, initially it will error with "Connection reset by peer". Subsequent 'bounces' will be fine, unless the communications are ceased for a few minutes (10? 30?) it will again give and initial "Connection reset by peer".
Linux 2.0 and 2.2: SSH, SCP (2 in a row), and POP3 (qpopper).
Solaris 7 x86: http (Netscape), telnet (SetSockOpt: invalid argument).
I'm sure there are other services I havent't list that it is a problem. Under Linux Netscape is NOT a problem.
Yes I know idealy it can be set up so the router bounce is not needed. But is there actually some underlying problem with the Linux code? (forwarding, firewall, or ipmasq?) From syslog, qpopper's failures look like this:
May 27 20:20:08 schizo in.qpopper[32335]: @zen-machine.psychosis.com: -ERR Too few arguments for the auth command.
Could the initial packets data be getting it's head or tail cut off? ===================================================================
-- http://www.linuxrouter.org/ Linux Router Project
marshall.us-state.gov - - [26/Apr/1999:09:27:40 -0400] "GET /robots.txt HTTP/1.0" 302 211
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |