In trying to setup some test services at home, i've run into an odd situation where it seems that centos7 instances cannot properly communicate through my home router (netgear r6400), whereas similarly configured centos6 instances can.
I setup a simple centos6 machine with httpd (vagrant 1.8.4 - geerlingguy/centos6 (virtualbox, 1.1.2), virtualbox 5.0.26, ansible, yum install), and connect to it via my LAN's ip (192.168.1.100). If I add a single port forwarding rule for port 80 in my r6400 router, I can then access it externally, i.e. via "mydomainname.com". If I change the port to something else, e.g. 88, in both the httpd.conf and router port forwarding, then changes are recognized right away.
HOWEVER....when I do the same with a centos 7 instance, I can only access the httpd via the LAN ip. The only differences in my setup are simply specifying a different vagrant box, "centos/7 (virtualbox, 1606.01)".
I'm FAR from a networking or linux guru, so I very well could be overlooking something simple. I've confirmed that both firewalld
and iptables
are both off. I'm not sure how to assess selinux
.
Here is the output from tcpdump -i enp0s8 -s 65535 >> /opt/tcpdump.txt
.
In the below:
- 192.168.1.11 - my laptop
- 192.168.1.111 - centos7-httpd
- 192.168.1.54 - note sure actually. no ip reservations and doesn't return a ping. an old, now disconnected DHCP'd device?
- cpe-external.isp.provider.com - from when i try to access mydomainname.com externally
14:51:22.253156 IP centos7-httpd.ssh > 192.168.1.10.55201: Flags [P.], seq 1610946846:1610947034, ack 3839393363, win 314, length 188
14:51:22.263652 IP 192.168.1.10.55201 > centos7-httpd.ssh: Flags [.], ack 188, win 52884, length 0
14:51:22.818952 ARP, Request who-has 192.168.1.54 tell 192.168.1.11, length 46
14:51:23.959272 ARP, Request who-has 192.168.1.54 tell 192.168.1.11, length 46
14:51:23.961179 IP6 fe80::1aaa:2d09:20e8:6a30.33333 > ff02::c.ssdp: UDP, length 146
14:51:23.979378 IP 192.168.1.11.54112 > centos7-httpd.kerberos: Flags [P.], seq 1708141637:1708142038, ack 1590313680, win 260, length 401
14:51:23.979654 IP centos7-httpd.kerberos > 192.168.1.11.54112: Flags [.], seq 1:2521, ack 401, win 279, length 2520
14:51:23.979707 IP centos7-httpd.kerberos > 192.168.1.11.54112: Flags [.], seq 2521:5041, ack 401, win 279, length 2520
14:51:23.979753 IP centos7-httpd.kerberos > 192.168.1.11.54112: Flags [P.], seq 5041:5205, ack 401, win 279, length 164
14:51:23.980131 IP 192.168.1.11.54112 > centos7-httpd.kerberos: Flags [.], ack 5205, win 260, length 0
14:51:24.058616 IP 192.168.1.11.54112 > centos7-httpd.kerberos: Flags [P.], seq 401:868, ack 5205, win 260, length 467
14:51:24.058677 IP 192.168.1.11.54113 > centos7-httpd.kerberos: Flags [P.], seq 2665849367:2665849830, ack 1191583241, win 260, length 463
14:51:24.059194 IP centos7-httpd.kerberos > 192.168.1.11.54112: Flags [P.], seq 5205:5385, ack 868, win 287, length 180
14:51:24.059276 IP centos7-httpd.kerberos > 192.168.1.11.54113: Flags [P.], seq 1:181, ack 463, win 270, length 180
14:51:24.061688 IP 192.168.1.11.54113 > centos7-httpd.kerberos: Flags [P.], seq 463:930, ack 181, win 260, length 467
14:51:24.061844 IP centos7-httpd.kerberos > 192.168.1.11.54113: Flags [P.], seq 181:360, ack 930, win 279, length 179
14:51:24.061915 IP 192.168.1.11.54112 > centos7-httpd.kerberos: Flags [P.], seq 868:1335, ack 5385, win 260, length 467
14:51:24.062115 IP centos7-httpd.kerberos > 192.168.1.11.54112: Flags [P.], seq 5385:5564, ack 1335, win 296, length 179
14:51:24.076216 IP 192.168.1.11.54112 > centos7-httpd.kerberos: Flags [P.], seq 1335:1771, ack 5564, win 259, length 436
14:51:24.076250 IP 192.168.1.11.54113 > centos7-httpd.kerberos: Flags [P.], seq 930:1368, ack 360, win 259, length 438
14:51:24.076420 IP centos7-httpd.kerberos > 192.168.1.11.54112: Flags [P.], seq 5564:6018, ack 1771, win 304, length 454
14:51:24.076468 IP centos7-httpd.kerberos > 192.168.1.11.54113: Flags [P.], seq 360:816, ack 1368, win 287, length 456
14:51:24.092472 STP 802.1d, Config, Flags [none], bridge-id 3000.78:24:ee:50:90:70.4444, length 43
14:51:24.129280 IP 192.168.1.11.54112 > centos7-httpd.kerberos: Flags [.], ack 6018, win 257, length 0
14:51:24.129303 IP 192.168.1.11.54113 > centos7-httpd.kerberos: Flags [.], ack 816, win 257, length 0
14:51:24.204108 IP 192.168.1.11.54113 > centos7-httpd.kerberos: Flags [P.], seq 1368:1803, ack 816, win 257, length 435
14:51:24.204255 IP 192.168.1.11.54112 > centos7-httpd.kerberos: Flags [P.], seq 1771:2208, ack 6018, win 257, length 437
14:51:24.204380 IP centos7-httpd.kerberos > 192.168.1.11.54113: Flags [P.], seq 816:1269, ack 1803, win 296, length 453
14:51:24.204505 IP centos7-httpd.kerberos > 192.168.1.11.54112: Flags [P.], seq 6018:6473, ack 2208, win 312, length 455
14:51:24.254379 IP 192.168.1.11.54113 > centos7-httpd.kerberos: Flags [.], ack 1269, win 260, length 0
14:51:24.254401 IP 192.168.1.11.54112 > centos7-httpd.kerberos: Flags [.], ack 6473, win 260, length 0
14:51:24.819415 ARP, Request who-has 192.168.1.54 tell 192.168.1.11, length 46
14:51:25.713147 IP gateway.tivoconnect > 192.168.1.255.tivoconnect: UDP, length 166
14:51:25.819526 ARP, Request who-has 192.168.1.54 tell 192.168.1.11, length 46
14:51:26.092396 STP 802.1d, Config, Flags [none], bridge-id 3000.78:24:ee:50:90:70.4444, length 43
14:51:26.296344 IP cpe-external.isp.provider.com.54116 > centos7-httpd.kerberos: Flags [S], seq 3514904834, win 8192, options [mss 1260,nop,wscale 8,nop,nop,sackOK], length 0
14:51:26.297392 IP cpe-external.isp.provider.com.54117 > centos7-httpd.kerberos: Flags [S], seq 3514113067, win 8192, options [mss 1260,nop,wscale 8,nop,nop,sackOK], length 0
14:51:26.438969 IP cpe-external.isp.provider.com.54118 > centos7-httpd.kerberos: Flags [S], seq 2521192680, win 8192, options [mss 1260,nop,wscale 8,nop,nop,sackOK], length 0
14:51:26.961276 IP6 fe80::1aaa:2d09:20e8:6a30.33333 > ff02::c.ssdp: UDP, length 146
14:51:26.965271 ARP, Request who-has 192.168.1.54 tell 192.168.1.11, length 46
14:51:27.820018 ARP, Request who-has 192.168.1.54 tell 192.168.1.11, length 46
14:51:28.092498 STP 802.1d, Config, Flags [none], bridge-id 3000.78:24:ee:50:90:70.4444, length 43
14:51:28.632329 IP 192.168.1.10.55201 > centos7-httpd.ssh: Flags [P.], seq 1:37, ack 188, win 52884, length 36
Some commands to verify the current machine configs:
[root@localhost ~]# iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
[root@localhost ~]# service iptables status
Redirecting to /bin/systemctl status iptables.service
● iptables.service
Loaded: not-found (Reason: No such file or directory)
Active: inactive (dead)
[root@localhost ~]# service firewalld status
Redirecting to /bin/systemctl status firewalld.service
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
Active: inactive (dead)
[root@localhost ~]# ip route
default via 10.0.2.2 dev eth0 proto static metric 100
default via 192.168.1.1 dev eth1 proto static metric 101
10.0.2.0/24 dev eth0 proto kernel scope link src 10.0.2.15 metric 100
192.168.1.0/24 dev eth1 proto kernel scope link src 192.168.1.111 metric 100
Update 1
I've come to the conclusion that whatever the problem is, its specific to vagrant+centos7, and i've tried the same basic setup with a variety of vagrant+centos6 machines, and haven't had any problems.
Similarly, i've created some Centos7 VirtualBox VM's "manually" (i.e. with an iso), and they seem to work fine, but when I package the manually created centos7 machines into a vagrant box, i get the problem with external accessibility.
Update 2 I just found that removing the NAT network adapter resolves the problem. I removed the /etc/sysconfig/network-scripts/ifcfg-eth0, shutdown the machine, manually removed the network adapter in VirtualBox, restarted, and voila - it now works fine. i'm not sure exactly why the NAT appears to be causing this problem, but its at least something new to focus on!
firewall-cmd
, and all port bind rules with selinux. Could any of these by your issue?firewalld
andiptables
are both off, but I'm not sure how to assessselinux
. that said, without some special configurations, i'm not sure why access would be fine from the LAN but blocked when originating externally?geerlingguy/centos7
? That box is usually a little more up-to-date than the official one...