0

In trying to setup some test services at home, i've run into an odd situation where it seems that centos7 instances cannot properly communicate through my home router (netgear r6400), whereas similarly configured centos6 instances can.

I setup a simple centos6 machine with httpd (vagrant 1.8.4 - geerlingguy/centos6 (virtualbox, 1.1.2), virtualbox 5.0.26, ansible, yum install), and connect to it via my LAN's ip (192.168.1.100). If I add a single port forwarding rule for port 80 in my r6400 router, I can then access it externally, i.e. via "mydomainname.com". If I change the port to something else, e.g. 88, in both the httpd.conf and router port forwarding, then changes are recognized right away.

HOWEVER....when I do the same with a centos 7 instance, I can only access the httpd via the LAN ip. The only differences in my setup are simply specifying a different vagrant box, "centos/7 (virtualbox, 1606.01)".

I'm FAR from a networking or linux guru, so I very well could be overlooking something simple. I've confirmed that both firewalld and iptables are both off. I'm not sure how to assess selinux.

Here is the output from tcpdump -i enp0s8 -s 65535 >> /opt/tcpdump.txt.

In the below:

  • 192.168.1.11 - my laptop
  • 192.168.1.111 - centos7-httpd
  • 192.168.1.54 - note sure actually. no ip reservations and doesn't return a ping. an old, now disconnected DHCP'd device?
  • cpe-external.isp.provider.com - from when i try to access mydomainname.com externally

14:51:22.253156 IP centos7-httpd.ssh > 192.168.1.10.55201: Flags [P.], seq 1610946846:1610947034, ack 3839393363, win 314, length 188
14:51:22.263652 IP 192.168.1.10.55201 > centos7-httpd.ssh: Flags [.], ack 188, win 52884, length 0
14:51:22.818952 ARP, Request who-has 192.168.1.54 tell 192.168.1.11, length 46
14:51:23.959272 ARP, Request who-has 192.168.1.54 tell 192.168.1.11, length 46
14:51:23.961179 IP6 fe80::1aaa:2d09:20e8:6a30.33333 > ff02::c.ssdp: UDP, length 146
14:51:23.979378 IP 192.168.1.11.54112 > centos7-httpd.kerberos: Flags [P.], seq 1708141637:1708142038, ack 1590313680, win 260, length 401
14:51:23.979654 IP centos7-httpd.kerberos > 192.168.1.11.54112: Flags [.], seq 1:2521, ack 401, win 279, length 2520
14:51:23.979707 IP centos7-httpd.kerberos > 192.168.1.11.54112: Flags [.], seq 2521:5041, ack 401, win 279, length 2520
14:51:23.979753 IP centos7-httpd.kerberos > 192.168.1.11.54112: Flags [P.], seq 5041:5205, ack 401, win 279, length 164
14:51:23.980131 IP 192.168.1.11.54112 > centos7-httpd.kerberos: Flags [.], ack 5205, win 260, length 0
14:51:24.058616 IP 192.168.1.11.54112 > centos7-httpd.kerberos: Flags [P.], seq 401:868, ack 5205, win 260, length 467
14:51:24.058677 IP 192.168.1.11.54113 > centos7-httpd.kerberos: Flags [P.], seq 2665849367:2665849830, ack 1191583241, win 260, length 463
14:51:24.059194 IP centos7-httpd.kerberos > 192.168.1.11.54112: Flags [P.], seq 5205:5385, ack 868, win 287, length 180
14:51:24.059276 IP centos7-httpd.kerberos > 192.168.1.11.54113: Flags [P.], seq 1:181, ack 463, win 270, length 180
14:51:24.061688 IP 192.168.1.11.54113 > centos7-httpd.kerberos: Flags [P.], seq 463:930, ack 181, win 260, length 467
14:51:24.061844 IP centos7-httpd.kerberos > 192.168.1.11.54113: Flags [P.], seq 181:360, ack 930, win 279, length 179
14:51:24.061915 IP 192.168.1.11.54112 > centos7-httpd.kerberos: Flags [P.], seq 868:1335, ack 5385, win 260, length 467
14:51:24.062115 IP centos7-httpd.kerberos > 192.168.1.11.54112: Flags [P.], seq 5385:5564, ack 1335, win 296, length 179
14:51:24.076216 IP 192.168.1.11.54112 > centos7-httpd.kerberos: Flags [P.], seq 1335:1771, ack 5564, win 259, length 436
14:51:24.076250 IP 192.168.1.11.54113 > centos7-httpd.kerberos: Flags [P.], seq 930:1368, ack 360, win 259, length 438
14:51:24.076420 IP centos7-httpd.kerberos > 192.168.1.11.54112: Flags [P.], seq 5564:6018, ack 1771, win 304, length 454
14:51:24.076468 IP centos7-httpd.kerberos > 192.168.1.11.54113: Flags [P.], seq 360:816, ack 1368, win 287, length 456
14:51:24.092472 STP 802.1d, Config, Flags [none], bridge-id 3000.78:24:ee:50:90:70.4444, length 43
14:51:24.129280 IP 192.168.1.11.54112 > centos7-httpd.kerberos: Flags [.], ack 6018, win 257, length 0
14:51:24.129303 IP 192.168.1.11.54113 > centos7-httpd.kerberos: Flags [.], ack 816, win 257, length 0
14:51:24.204108 IP 192.168.1.11.54113 > centos7-httpd.kerberos: Flags [P.], seq 1368:1803, ack 816, win 257, length 435
14:51:24.204255 IP 192.168.1.11.54112 > centos7-httpd.kerberos: Flags [P.], seq 1771:2208, ack 6018, win 257, length 437
14:51:24.204380 IP centos7-httpd.kerberos > 192.168.1.11.54113: Flags [P.], seq 816:1269, ack 1803, win 296, length 453
14:51:24.204505 IP centos7-httpd.kerberos > 192.168.1.11.54112: Flags [P.], seq 6018:6473, ack 2208, win 312, length 455
14:51:24.254379 IP 192.168.1.11.54113 > centos7-httpd.kerberos: Flags [.], ack 1269, win 260, length 0
14:51:24.254401 IP 192.168.1.11.54112 > centos7-httpd.kerberos: Flags [.], ack 6473, win 260, length 0
14:51:24.819415 ARP, Request who-has 192.168.1.54 tell 192.168.1.11, length 46
14:51:25.713147 IP gateway.tivoconnect > 192.168.1.255.tivoconnect: UDP, length 166
14:51:25.819526 ARP, Request who-has 192.168.1.54 tell 192.168.1.11, length 46
14:51:26.092396 STP 802.1d, Config, Flags [none], bridge-id 3000.78:24:ee:50:90:70.4444, length 43
14:51:26.296344 IP cpe-external.isp.provider.com.54116 > centos7-httpd.kerberos: Flags [S], seq 3514904834, win 8192, options [mss 1260,nop,wscale 8,nop,nop,sackOK], length 0
14:51:26.297392 IP cpe-external.isp.provider.com.54117 > centos7-httpd.kerberos: Flags [S], seq 3514113067, win 8192, options [mss 1260,nop,wscale 8,nop,nop,sackOK], length 0
14:51:26.438969 IP cpe-external.isp.provider.com.54118 > centos7-httpd.kerberos: Flags [S], seq 2521192680, win 8192, options [mss 1260,nop,wscale 8,nop,nop,sackOK], length 0
14:51:26.961276 IP6 fe80::1aaa:2d09:20e8:6a30.33333 > ff02::c.ssdp: UDP, length 146
14:51:26.965271 ARP, Request who-has 192.168.1.54 tell 192.168.1.11, length 46
14:51:27.820018 ARP, Request who-has 192.168.1.54 tell 192.168.1.11, length 46
14:51:28.092498 STP 802.1d, Config, Flags [none], bridge-id 3000.78:24:ee:50:90:70.4444, length 43
14:51:28.632329 IP 192.168.1.10.55201 > centos7-httpd.ssh: Flags [P.], seq 1:37, ack 188, win 52884, length 36

Some commands to verify the current machine configs:

[root@localhost ~]#  iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
[root@localhost ~]# service iptables status
Redirecting to /bin/systemctl status  iptables.service
● iptables.service
   Loaded: not-found (Reason: No such file or directory)
   Active: inactive (dead)
[root@localhost ~]# service firewalld status
Redirecting to /bin/systemctl status  firewalld.service
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
   Active: inactive (dead)
[root@localhost ~]# ip route
default via 10.0.2.2 dev eth0  proto static  metric 100
default via 192.168.1.1 dev eth1  proto static  metric 101
10.0.2.0/24 dev eth0  proto kernel  scope link  src 10.0.2.15  metric 100
192.168.1.0/24 dev eth1  proto kernel  scope link  src 192.168.1.111  metric 100

Update 1 I've come to the conclusion that whatever the problem is, its specific to vagrant+centos7, and i've tried the same basic setup with a variety of vagrant+centos6 machines, and haven't had any problems.
Similarly, i've created some Centos7 VirtualBox VM's "manually" (i.e. with an iso), and they seem to work fine, but when I package the manually created centos7 machines into a vagrant box, i get the problem with external accessibility.

Update 2 I just found that removing the NAT network adapter resolves the problem. I removed the /etc/sysconfig/network-scripts/ifcfg-eth0, shutdown the machine, manually removed the network adapter in VirtualBox, restarted, and voila - it now works fine. i'm not sure exactly why the NAT appears to be causing this problem, but its at least something new to focus on!

4
  • CentOS has some default iptables rules with firewall-cmd, and all port bind rules with selinux. Could any of these by your issue?
    – Matt Clark
    Jul 28, 2016 at 19:39
  • i've updated the description to include that firewalld and iptables are both off, but I'm not sure how to assess selinux. that said, without some special configurations, i'm not sure why access would be fine from the LAN but blocked when originating externally?
    – swv
    Jul 28, 2016 at 23:52
  • Have you tried geerlingguy/centos7? That box is usually a little more up-to-date than the official one... Aug 7, 2016 at 4:08
  • yes, I did test with your box, but unfortunately, it seems to have the same problem. thus why i've concluded that its something with centos/rhel 7 + vagrant, not just one or more specific vagrant boxes. btw, thanks for the great boxes!
    – swv
    Aug 7, 2016 at 20:43

1 Answer 1

0

Use "setenforce 0" to switch selinux to permissive mode. This will continue to assess issues, but will not block the action, only log it. This way you will at least determine if it is an selinux issue and if so what.

9
  • i've executed "setenforce 0", but still get the same behavior, i.e. some activity shows in the tcpdump, but i'm not able to connect and I'm not sure what exactly the tcpdump is showing.
    – swv
    Aug 2, 2016 at 21:48
  • "some activity shows in the tcpdump" .. If you could paste that in here it might help Aug 4, 2016 at 11:16
  • the above excerpt from the tcpdump shows what I was referring to, i.e. i've substitute out the specific IP with "cpe-external.isp.provider.com"
    – swv
    Aug 4, 2016 at 19:42
  • As you assert you can connect form outside to the VM when it isn't CentOS 7 on Vagrant, I am assuming that the whole port forward/NAT thing is working properly. Can you confirm that the packets from the outside are getting to the CentOS 7 on Vagrant machine ? A tcpdump from that machine perhaps ? Aug 5, 2016 at 10:09
  • the tcpdump in the description is from the problematic vagrant-centos7 machine
    – swv
    Aug 5, 2016 at 18:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .