Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In a classical SOHO setup I am running a Debian box as router/firewall. For an unknown time now I have an issue, where the MASQUERADING on the output connection (PPPoE) stops working for one of the clients. This is visible as sending out the private IP address onto the internet link. The further confusion issue is that this only happens for one of the clients (while others work at the same time).

The issues seems to be triggered by transfer volume and resolves itself after some time.

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -i lo -j ACCEPT 
-A INPUT -i br0 -j ACCEPT 
-A INPUT -i eth0 -j ACCEPT 
-A INPUT -p tcp -m state --state NEW --dport 22 -i ppp0 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -p tcp -m state --state NEW --dport 22 -i ppp0 -d 192.168.178.3 -j ACCEPT
-A FORWARD -p tcp -m state --state NEW --dport 80 -i ppp0 -d 192.168.178.3 -j ACCEPT
-A FORWARD -p tcp -m state --state NEW --dport 8000 -i ppp0 -d 192.168.178.3 -j ACCEPT
-A FORWARD -p udp -m state --state NEW --dport 5060 -i ppp0 -j ACCEPT
-A FORWARD -p udp -m state --state NEW --dport 17070:17078 -i ppp0 -j ACCEPT
-A FORWARD -i br0 -j ACCEPT 
-A FORWARD -i eth0 -j ACCEPT 
-A FORWARD -i ppp0 -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A OUTPUT -o lo -j ACCEPT 
-A OUTPUT -o br0 -j ACCEPT 
-A OUTPUT -o eth0 -j ACCEPT 
-A OUTPUT -o ppp0 -j ACCEPT 

*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING  -i ppp0 -d XXX.XXX.XXX.32 -p udp -m udp --dport 5060 -j DNAT --to-destination 192.168.178.4
-A PREROUTING  -i ppp0 -d XXX.XXX.XXX.32 -p udp -m udp --dport 17070:17078 -j DNAT --to-destination 192.168.178.4
-A PREROUTING  -i ppp0 -d XXX.XXX.XXX.33 -p udp -m udp --dport 5060 -j DNAT --to-destination 192.168.178.5
-A PREROUTING  -i ppp0 -d XXX.XXX.XXX.33 -p udp -m udp --dport 17070:17078 -j DNAT --to-destination 192.168.178.5
-A PREROUTING  -i ppp0 -d XXX.XXX.XXX.34 -p tcp -m tcp --dport 22 -j DNAT --to-destination 192.168.178.3
-A PREROUTING  -i ppp0 -d XXX.XXX.XXX.34 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.178.3
-A PREROUTING  -i ppp0 -d XXX.XXX.XXX.34 -p tcp -m tcp --dport 8000 -j DNAT --to-destination 192.168.178.3
-A POSTROUTING -o ppp0 -s 192.168.178.4 -j SNAT --to XXX.XXX.XXX.32
-A POSTROUTING -o ppp0 -s 192.168.178.5 -j SNAT --to XXX.XXX.XXX.33
-A POSTROUTING -o ppp0 -s 192.168.178.3 -j SNAT --to XXX.XXX.XXX.34
-A POSTROUTING -o ppp0 -j MASQUERADE
-A POSTROUTING -o eth0 -j MASQUERADE 
share|improve this question
    
What do your network settings and firewall rules look like? –  Matt H Feb 20 '13 at 20:11
    
updated the post to show the firewall rules, network settings are static IPs on eth0, br0 (LAN) and ppp0 (WAN) –  02strich Feb 20 '13 at 20:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.