<html><head></head><body><div>I actually setup an iptable trace target</div><div><br></div><div>example:</div><div><br></div><div><pre><code>iptables -t raw -A PREROUTING -p tcp --destination <myexternalhostip> --dport 80 -j TRACE #tweak the rules to select just traffic you want
iptables -t raw -A OUTPUT -p tcp --destination <myinternalhostip> --dport 80 -j TRACE #uses internal IP now since after the DNAT rule</code></pre><pre><code><br></code></pre><pre><code>Now tail -f /var/log/messages</code></pre><pre><code><br></code></pre><pre><code>Oh. Need to set kern.*</code><strong>;</strong>*.info;mail.none;authpriv.none;cron.none /var/log/messages in /etc/rsyslog.conf and restart rsyslog.</pre></div><div>On Fri, 2018-01-26 at 14:27 -0500, Ed Cashin wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div dir="ltr">By "tracing it through" do you mean looking at the counts for the iptables rules, and noticing which rules incremented and which did not?<div><br></div><div>Tracing with tcpdump is great for debugging, but I don't see how that would catch things getting stopped between chains inside the kernel---that's why I ask.</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Jan 26, 2018 at 2:12 PM, Jim Kinney via Ale <span dir="ltr"><<a href="mailto:ale@ale.org" target="_blank">ale@ale.org</a>></span> wrote:<br><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div><div>Sounds like a routing problem. ip route will show the defaults. If BOTH are not pointed at each other, nothing happens. Verify with tcpdump on both ends - look for traffic to/from <host></div><div><br></div><div>Host A has nics 1 & 2 (A1 & A2)</div><div>Host B has nics 1 & 2 (B1 & B2)</div><div><br></div><div>Assumption is A1 and B1 are on network 192.168.0.0 and A2 and B2 are on 10.1.1.0. Assumption default route is 192.168.0.0.</div><div><br></div><div>To get those machines to talk on the 10.1.1.0 network, you will need to use explicit IP address and adding a custom name in /etc/hosts is a good idea.</div><div><br></div><div>Also need to verify that the database is listing on the correct IP - ditto for tomcat.</div><div><br></div><div>I just spent _days_ trying to trace a multi-homed network FSCKUP through iptables. Data in on port A never appears anywhere else. tracing it through just showed where it vanished - between PREROUTING RAW and PREROUTING NAT. I feel your pain.</div><div><div class="h5"><div><br></div><div>On Fri, 2018-01-26 at 13:01 -0500, leam hall via Ale wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><pre>Using RHEL 6, two hosts (A, B) each with two NICs, Each host has one
NIC on each of two VLANs. Tomcat on Host_A rying to connect to MySQL
on Host_B, port 3306. iptables on Host_B looks open (0.0.0.0) for
TCP/3306.
Host_A_NIC_0 can connect to Host_B_NIC_0 TCP/3306
HOST_A_NIC_1 can NOT connect to HOST_B_NIC_1 TCP/3306.
They are 1 IP off and NIC_1 can ping NIC_1, but not connect TCP/3306.
Thoughts on how to figure out why when iptables looks open?
Leam
______________________________<wbr>_________________
Ale mailing list
<a href="mailto:Ale@ale.org" target="_blank">Ale@ale.org</a>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/<wbr>listinfo/ale</a>
See JOBS, ANNOUNCE and SCHOOLS lists at
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/<wbr>listinfo</a>
</pre></blockquote></div></div><span class="HOEnZb"><font color="#888888"><div><span><pre><pre>-- <br></pre>James P. Kinney III
Every time you stop a school, you will have to build a jail. What you
gain at one end you lose at the other. It's like feeding a dog on his
own tail. It won't fatten the dog.
- Speech 11/23/1900 Mark Twain
<a href="http://heretothereideas.blogspot.com/" target="_blank">http://heretothereideas.<wbr>blogspot.com/</a>
</pre></span></div></font></span></div><br>______________________________<wbr>_________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" rel="noreferrer" target="_blank">http://mail.ale.org/mailman/<wbr>listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" rel="noreferrer" target="_blank">http://mail.ale.org/mailman/<wbr>listinfo</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div></div></blockquote><div><span><pre><pre>-- <br></pre>James P. Kinney III
Every time you stop a school, you will have to build a jail. What you
gain at one end you lose at the other. It's like feeding a dog on his
own tail. It won't fatten the dog.
- Speech 11/23/1900 Mark Twain
http://heretothereideas.blogspot.com/
</pre></span></div></body></html>