Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A website is not opening on a computer that's connected via shared connection (not exactly "shared"). Pinging the website gets Packet filtered message.

The setup of my home network is done by Ubuntu manual:

Master PC: Ubuntu 9.10. eth1 for provider's connection, eth2 for the internal, with dhcp3 that gives IP to the slave pc. My ISP provides internet via VPN: LAN is accessible via DHCP, to get Internet I use pppd and a script with manual routing with iptables (I don't check the "share this connection" box, it won't work at all this way).

Here's the script:

sudo iptables -A FORWARD -i eth0 -o eth1 -s -m conntrack --ctstate NEW -j ACCEPT
sudo iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A POSTROUTING -t nat -j MASQUERADE 

And the iptables rules on the master PC:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --       anywhere            ctstate NEW 
ACCEPT     all  --  anywhere             anywhere            ctstate RELATED,ESTABLISHED 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

On this one, I write the website address, and it works perfectly.

Slave PC: Ubuntu 9.04 laptop. Ethernet connection with DHCP. Can't open or ping the website, packet filtered. The Iptables rules on slave PC are:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination   

Right now I've seen only ( filtered by this issue, and I can't say whether other sites are affected: so far we haven't noticed an issue with any of them.

I've tried some tests and here's what I see:

  1. nslookup works on both PCs
  2. ping doesn't work on any ("packet filtered" message)
  3. telnet 80 then GET / returns a "301 Moved permanently" message from the server on both computers.
  4. Still, Opera/Firefox can open this website only from Master PC. The slave PC infinitely waits for reply from server.

How can I find the sourse of the problem? (I guess it's Iptables rule)

share|improve this question
Without seeing your iptables script, there's no way to know which rule is causing your problems. – camh Feb 2 '10 at 9:54
Added the script – culebrón Feb 2 '10 at 10:21
one particular website or all of them? – quack quixote Feb 2 '10 at 21:04
@Phoshi: I guess that follows. This message will self-destruct... – Charles Stewart Feb 6 '10 at 15:22

Since the default policy for all the chains on the gateway machine is accept I think that this problem has nothing to do with iptables rules. Its more likely due to ppp/vpn MTU packet sizes.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.