One website not connecting over shared connection

Question

A website is not opening on a computer that's connected via shared connection (not exactly "shared"). Pinging the website gets Packet filtered message.

The setup of my home network is done by Ubuntu manual:

Master PC: Ubuntu 9.10. eth1 for provider's connection, eth2 for the internal, with dhcp3 that gives IP to the slave pc. My ISP provides internet via VPN: LAN is accessible via DHCP, to get Internet I use pppd and a script with manual routing with iptables (I don't check the "share this connection" box, it won't work at all this way).

Here's the script:

sudo iptables -A FORWARD -i eth0 -o eth1 -s 192.168.0.0/24 -m conntrack --ctstate NEW -j ACCEPT
sudo iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A POSTROUTING -t nat -j MASQUERADE 

And the iptables rules on the master PC:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  192.168.0.0/24       anywhere            ctstate NEW 
ACCEPT     all  --  anywhere             anywhere            ctstate RELATED,ESTABLISHED 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

On this one, I write the website address, and it works perfectly.

Slave PC: Ubuntu 9.04 laptop. Ethernet connection with DHCP. Can't open or ping the website, packet filtered. The Iptables rules on slave PC are:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination   

Right now I've seen only www.s7.ru (89.249.20.27) filtered by this issue, and I can't say whether other sites are affected: so far we haven't noticed an issue with any of them.

I've tried some tests and here's what I see:

1. nslookup works on both PCs
2. ping doesn't work on any ("packet filtered" message)
3. telnet www.s7.ru 80 then GET / returns a "301 Moved permanently" message from the server on both computers.
4. Still, Opera/Firefox can open this website only from Master PC. The slave PC infinitely waits for reply from server.

How can I find the sourse of the problem? (I guess it's Iptables rule)

Answer 1

Since the default policy for all the chains on the gateway machine is accept I think that this problem has nothing to do with iptables rules. Its more likely due to ppp/vpn MTU packet sizes.