As I tried to remove some Ethernet wires in my home network, I took an older notebook with Linux and tried to use it as some kind of Ethernet-2-WiFi-NAT-router (Wi-Fi card can't act as bridge, so I had to do NAT). Basically, this works, but all the clients behind this NAT router get network errors on TCP connections from time to time.
First, here is the complete setup:
INTERNET > wire > Standard Wi-Fi Router > air > Linux Router > Clients
After some sniffing on the Linux router and the clients I found out the following:
- the client connects as usual to the remote server and retrieves some data
- client gets busy (e.g., writing data to disk) and the receive window gets full
- the client then basically tells the server to wait; in my case either ACK with win=0 or win < MTU is the last ACK I can see in capture before the connection breaks
- while this last ACK is traveling, there are still some packets arriving from the remote server
- the Linux router responds to each of these packets with a RST to the remote server and therefore destroys the connection
- the client is confused because it gets a RST from the server in response to the next packet the client sends
So it's  which is my problem here, and I would like to know why this happens and how to fix it.
Other things to mention:
- the wireless network itself works fine
- all clients not behind the Linux box work fine
- UDP works fine as far as I can tell
iptableson the Linux router is just minimal
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE iptables -I FORWARD -i eth1 -o eth0 -s 192.168.2.0/24 -d 192.168.1.0/24 -j ACCEPT # for static routing iptables -I FORWARD -i eth0 -o eth1 -s 192.168.1.0/24 -d 192.168.2.0/24 -j ACCEPT # for static routing
I also found out that setting the policy of the input chain to drop helps, since it drops the unwanted packets that lead to the reset, but that's IMHO just a dirty fix.