Okay, I'm stumped. I seem to inexplicably be cut off from large chunks of the web.

I have a firewall connected to a DSL line. I'm using iptables with NAT turned on. My internal net has two machines on it. On my internal machines, there is a subset of websites that I just cannot seem to access -- for example, news.yahoo.com. I can get to yahoo.com, but not to any of the subdomains -- the browser just gets a timeout error. Sometimes it seems to be browser specific -- I can access google.com with Mozilla, but not Konquerer (timeout error). Sometimes the browser makes no difference.

As a test, I logged onto every single one of my machines at the same time, and fired up links (so I'm using the same browser on everything), and tried to surf to news.yahoo.com. Internal net... no dice. Firewall... no problem. I can successfully ping that server from any machine, firewall or internal net.

I logged the packets going to/from my firewall to the news.yahoo.com while surfing from the firewall, to see what a successful connection looks like. Then I logged the packets going to/from an internal machine. I haven't fully gone through the logs to see what's missing, but there is a significant amount of stuff that's not being passed through the firewall -- it doesn't even look as though the same sequence of packets is being sent.

Any suggestions on where I start looking for the problem? I've tried simplifying my firewall rules to just let everything in/out, but it didn't seem to have much of an effect.

Thanks,

Any suggestions on where I start looking for the problem?

Do you connect to your ISP with PPPoE by any chance? If so that sounds exactly like what happens if the MTU on your machines hasn't been decreased. Most firewalls/routers that do pppoe and NAT compensate for you these days though. Do a google search for something like 'adjust pppoe mtu' for more info.

-Mike

Funny, I was going to say it sounded like DNS trouble.

Funny, I was going to say it sounded like DNS trouble.

Bah, never start troubleshooting by looking for the easy solution Actually, you may very will be correct, the MTU thing just popped into my head because I spent some time fighting those exact symptoms when ISPs had just started implementing PPPoE a couple of years back and there was almost no documentation on the problem.

-Mike

Yep. I agree. I've seen this problem a few times.

If this is how he's connecting it's a fairly easy fix:

From: http://www.roaringpenguin.com/pppoe/how-to-connect.txt

I) I can browse some web sites just fine, but others stall forever.



There is probably a buggy router or firewall between you and the Web server.

One possible workaround:  In /etc/ppp/pppoe.conf, find the line which reads:



	CLAMPMSS=1412



Try lowering the 1412 until it works (go down in steps of 100 or so.)  Each

time you lower the value, you have to restart your connection like this:



	adsl-stop; adsl-start



This should work around buggy routers which do not support Path MTU discovery.

not just applied an update to XP by chance?

But I suppose if you are running Konquerer then you must be on a *ix system, so you don't do stuff like that.!

Okay. Going for highly unlikely here but you haven't turned on ECN support have you?

- Trevor

Do you connect to your ISP with PPPoE by any chance? If so that sounds exactly like what happens if the MTU on your machines hasn't been decreased. Most firewalls/routers that do pppoe and NAT compensate for you these days though. Do a google search for something like 'adjust pppoe mtu' for more info.

I do. I know I lowered the MTU when I first set it up, though. Hmm.... my ppp0 is set to 1492, but eth0 (the physical card ppp0 is running over) is set to 1500. I'll try lowering this, and see what happens.

DNS

Yeah, I wondered about that when I first ran into this, and it's what my brother suggested might be the problem, as well. However, that wouldn't account for why I can ping the server in question using its canonical host name, and get a reply back, but get no reply with http.

If it's a problem with the MTU, as suggested, that makes more sense, since (I'm guessing) the ICMP packets are tiny, whereas the HTTP packets in question are much bigger, and get stuck.

not just applied an update to XP by chance?

XP? Lord, no. The last Microsoft patch I applied was called "Linux", and that was over 4 years ago.

But I suppose if you are running Konquerer then you must be on a *ix system, so you don't do stuff like that!

Some people dual boot, so it seems a fair question. Not the answer I need, though.

ECN support

Uh... I don't think so. I have no clue what that is, so I'm going to assume no. You've tempted me to find out what it is, though, and enable it, just to see what it does. One problem at a time, though...

*sigh MTU of 1492 seems to be hardwired somehow -- probably due to the fact that my pppoe setup is fairly ancient (i.e. dating back about 3 years). Looks like this is going to be a little more involved than a simple little fix.

MTU of 1492 seems to be hardwired somehow

Yeah, the pppoe spec is for 1492 so you have to make everything else match or some of your packets misteriously disapear. Try lowering the MTU on the NIC in one of your client machines that is having issues to something under 1492 and see if that helps. If it works then you'll want to figure out how to get your NAT software to fragment packets if necessary to keep them under that size.

-Mike

Woot. I managed to get it going with an MTU of 1452. Everything's happy now. It wasn't *quite* as simple as just changing a setting in the config file (that was part of it, though), but not as bad as I was expecting (i.e. I didn't have to hunt down the source code to the non-roaring penguin pppd implementation of pppoe that I was using). Thanks for the suggestions everybody!

A

ECN is Explicit Congestion Notification.and it's an extension to IPv4. It allows routers to tell each other about network congestion. THe problem is that some firewalls and routers don't understand the bit that turns on ECN and think the packet is invalid. Therefore you'd not be able to connect to certain websites and services.

It was unlikely you've turn it on but didn't hurt anything to ask

- Trevor

ICMP packets are tiny, whereas the HTTP packets in question are much bigger, and get stuck.

For future reference, this is fairly easy to diagnose, as most ping programs have a flag to allow you to change the size of the payload in the echo request packet.