>> I don't know if the output of tcpdump -nn helps or not: >> ... >> 16:02:40.803697 IP 128.252.85.35.22 > 128.252.85.103.2167: P > <snip /> > > oooh :( SSH makes alot of noise. Not too useful this way. > >> Here is iptables-save output: >> >> # Generated by iptables-save v1.3.5 on Mon May 15 15:59:18 2006 >> *filter >> :INPUT ACCEPT [0:0] >> :FORWARD ACCEPT [0:0] >> :OUTPUT ACCEPT [0:0] >> :RH-Firewall-1-INPUT - [0:0] >> :okay - [0:0] >> -A INPUT -j RH-Firewall-1-INPUT >> -A FORWARD -j RH-Firewall-1-INPUT >> -A OUTPUT -s 127.0.0.1 -j ACCEPT >> -A OUTPUT -s 128.252.85.35 -j ACCEPT >> -A RH-Firewall-1-INPUT -s 127.0.0.1 -i lo -j ACCEPT >> -A RH-Firewall-1-INPUT -s 128.252.85.35 -i lo -j ACCEPT >> -A RH-Firewall-1-INPUT -i lo -j ACCEPT >> -A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT >> -A RH-Firewall-1-INPUT -p ipv6-crypt -j ACCEPT >> -A RH-Firewall-1-INPUT -p ipv6-auth -j ACCEPT >> -A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT >> -A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT >> -A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT >> -A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT >> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m >> tcp >> --dport 21 -j ACCEPT >> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m >> tcp >> --dport 22 -j ACCEPT >> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m >> tcp >> --dport 25 -j ACCEPT >> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m >> tcp >> --dport 80 -j ACCEPT >> -A RH-Firewall-1-INPUT -p udp -m state --state NEW,RELATED,ESTABLISHED -m >> udp >> --dport 137 -j ACCEPT >> -A RH-Firewall-1-INPUT -p udp -m state --state NEW,RELATED,ESTABLISHED -m >> udp >> --dport 139 -j ACCEPT >> -A RH-Firewall-1-INPUT -s 128.252.85.0/255.255.255.0 -p tcp -m state --state >> NEW,RELATED,ESTABLISHED -m tcp --dport 2049 -j ACCEPT >> -A RH-Firewall-1-INPUT -s 128.252.85.0/255.255.255.0 -p udp -m state --state >> NEW,RELATED,ESTABLISHED -m udp --dport 2049 -j ACCEPT >> -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited >> -A okay -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j ACCEPT >> -A okay -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT >> COMMIT >> # Completed on Mon May 15 15:59:18 2006 >> >> I just added udp for nfs port, but still the same problem. >> > > Ok. Just looked through your "iptables-save". There is some > duplication but nothing that I can see that is wrong. > > Since you are hitting the REJECT you are not matching a previous rule. > From what I can see, the rules must be failing because > a) source address/mask isn't what is being used; > b) port number is not the one being used. > > If you use "tcpdump -nn port ! ssh" while you try using nfs you should > receive something more useable. > Here it is: # tcpdump -v -nn port ! ssh tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 16:44:14.724722 IP (tos 0x0, ttl 128, id 673, offset 0, flags [none], proto: UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 16:44:15.474700 IP (tos 0x0, ttl 128, id 708, offset 0, flags [none], proto: UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 16:44:15.657608 IP (tos 0xc0, ttl 2, id 0, offset 0, flags [none], proto: UDP (17), length: 48) 128.252.85.250.1985 > 224.0.0.2.1985: HSRPv0-hello 20: state=active group=85 addr=128.252.85.254 hellotime=3s holdtime=10s priority=110 auth="cisco^@^@^@" 16:44:15.673489 IP (tos 0x0, ttl 1, id 17732, offset 0, flags [none], proto: IGMP (2), length: 40, options ( RA (148) len 4 )) 128.252.85.91 > 224.0.0.22: igmp v3 report, 1 group record(s) [gaddr 239.255.255.250 to_in, 0 source(s)] 16:44:15.903332 802.1d config 8055.00:0d:65:75:74:80.8006 root 2000.00:09:44:d3:98:54 pathcost 23 age 2 max 20 hello 2 fdelay 15 16:44:16.187422 arp who-has 128.252.85.40 tell 128.252.85.189 16:44:16.215126 arp who-has 128.252.85.88 tell 128.252.85.189 16:44:16.224694 IP (tos 0x0, ttl 128, id 735, offset 0, flags [none], proto: UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 16:44:16.338898 IP (tos 0x0, ttl 1, id 17733, offset 0, flags [none], proto: IGMP (2), length: 40, options ( RA (148) len 4 )) 128.252.85.91 > 224.0.0.22: igmp v3 report, 1 group record(s) [gaddr 239.255.255.250 to_in, 0 source(s)] 16:44:17.099723 IP (tos 0x0, ttl 128, id 749, offset 0, flags [none], proto: UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 16:44:17.849770 IP (tos 0x0, ttl 128, id 851, offset 0, flags [none], proto: UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 16:44:17.905851 802.1d config 8055.00:0d:65:75:74:80.8006 root 2000.00:09:44:d3:98:54 pathcost 23 age 2 max 20 hello 2 fdelay 15 16:44:18.569998 IP (tos 0xc0, ttl 2, id 0, offset 0, flags [none], proto: UDP (17), length: 48) 128.252.85.250.1985 > 224.0.0.2.1985: HSRPv0-hello 20: state=active group=85 addr=128.252.85.254 hellotime=3s holdtime=10s priority=110 auth="cisco^@^@^@" 16:44:18.587619 aarp who-has 85.4.9 tell 85.1.4 16:44:18.599725 IP (tos 0x0, ttl 128, id 873, offset 0, flags [none], proto: UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 16:44:19.009393 16:44:19.903665 802.1d config 8055.00:0d:65:75:74:80.8006 root 2000.00:09:44:d3:98:54 pathcost 23 age 2 max 20 hello 2 fdelay 15 16:44:20.224157 et1 AT 85.4.9.1 > 0.0.1: at-rtmp 232 16:44:20.225361 IP (tos 0x0, ttl 128, id 19752, offset 0, flags [none], proto: UDP (17), length: 78) 128.252.85.66.137 > 128.252.85.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST ... I want to ask another question -- Why do we need the last line in the file iptables: -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited If I comment it out, then everything works. Will that cause firewall actually not functioning? In fc3,fc4 I don't see similar line in the default firewall setting. Something new in fc5? Thanks! Hongwei
