Cent os 7 Bridge interface iptables rules

We have a cent os server which has bridged p3p1 and p3p2 interfaces with name br0
yesterday our syn proxy rules were working today they have stopped strangely

appliled rules as given below but in an combination we could not let it hit to the firewall on bridged traffic.


sysctl -w net/ipv4/tcp_syncookies=1
sysctl -w net/ipv4/tcp_timestamps=1
sysctl -w net/netfilter/nf_conntrack_tcp_loose=0
echo 2500000 > /sys/module/nf_conntrack/parameters/hashsize
sysctl -w net.ipv4.ip_forward=1
sysctl -w net/netfilter/nf_conntrack_max=2000000
echo 1 > /proc/sys/net/ipv4/ip_forward
sysctl -p

Open in new window



[root@244 ~]# brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.a0369f557ca8       yes             p3p1
                                                        p3p2
[root@244 ~]# iptables -vL
Chain INPUT (policy ACCEPT 970 packets, 57781 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 SYNPROXY   tcp  --  br0    any     anywhere             anywhere             PHYSDEV match --physdev-in p3p2 tcp state INVALID,UNTRACKED SYNPROXY sack-perm timestamp wscale 7 mss 1460
    0     0 DROP       all  --  br0    any     anywhere             anywhere             PHYSDEV match --physdev-in p3p2 state INVALID
    0     0 SYNPROXY   tcp  --  br0    any     anywhere             anywhere             PHYSDEV match --physdev-in p3p1 tcp state INVALID,UNTRACKED SYNPROXY sack-perm timestamp wscale 7 mss 1460
    0     0 DROP       all  --  br0    any     anywhere             anywhere             PHYSDEV match --physdev-in p3p1 state INVALID

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 SYNPROXY   tcp  --  any    any     anywhere             anywhere             PHYSDEV match --physdev-in p3p1 tcp state INVALID,UNTRACKED SYNPROXY sack-perm timestamp wscale 7 mss 1460
    0     0 DROP       all  --  any    any     anywhere             anywhere             PHYSDEV match --physdev-in p3p1 state INVALID
    0     0 SYNPROXY   tcp  --  br0    any     anywhere             anywhere             PHYSDEV match --physdev-in p3p2 tcp state INVALID,UNTRACKED SYNPROXY sack-perm timestamp wscale 7 mss 1460
    0     0 DROP       all  --  br0    any     anywhere             anywhere             PHYSDEV match --physdev-in p3p2 state INVALID

Chain OUTPUT (policy ACCEPT 764 packets, 50748 bytes)
 pkts bytes target     prot opt in     out     source               destination
[root@244 ~]#

Open in new window

FireBallITAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Duncan RoeSoftware DeveloperCommented:
Please run this:

{ set -x;for i in filter nat mangle raw;do iptables -t $i -n -v --line-numbers -L;done;set +x; } 2>&1|tee iptables.txt

and post iptables.txt
0
FireBallITAuthor Commented:
I realize that p1p1 interface not forwarding the traffic. Because when i redirect the traffic to the em1 interface it works.
And also p1p1 interface only answer the 37.123.100.97 's ping requests no other ping request was not accepted by it

[root@249 network-scripts]# tcpdump -i p1p1 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on p1p1, link-type EN10MB (Ethernet), capture size 65535 bytes
13:18:19.118981 IP 26.156.9.185.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 14, seq 31499, length 40
13:18:19.268464 IP 97.100.123.37.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 33605, seq 603, length 64
13:18:19.268484 IP 98.100.123.37.salay.com.tr > 97.100.123.37.salay.com.tr: ICMP echo reply, id 33605, seq 603, length 64
13:18:20.269454 IP 97.100.123.37.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 33605, seq 604, length 64
13:18:20.269478 IP 98.100.123.37.salay.com.tr > 97.100.123.37.salay.com.tr: ICMP echo reply, id 33605, seq 604, length 64
13:18:21.270517 IP 97.100.123.37.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 33605, seq 605, length 64
13:18:21.270539 IP 98.100.123.37.salay.com.tr > 97.100.123.37.salay.com.tr: ICMP echo reply, id 33605, seq 605, length 64
13:18:21.775278 IP 78.186.179.127.static.ttnet.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 1, seq 2671, length 40
13:18:22.271453 IP 97.100.123.37.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 33605, seq 606, length 64
13:18:22.271476 IP 98.100.123.37.salay.com.tr > 97.100.123.37.salay.com.tr: ICMP echo reply, id 33605, seq 606, length 64
13:18:23.272469 IP 97.100.123.37.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 33605, seq 607, length 64
13:18:23.272491 IP 98.100.123.37.salay.com.tr > 97.100.123.37.salay.com.tr: ICMP echo reply, id 33605, seq 607, length 64
13:18:24.097221 IP 26.156.9.185.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 14, seq 31500, length 40
13:18:24.273466 IP 97.100.123.37.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 33605, seq 608, length 64
13:18:24.273488 IP 98.100.123.37.salay.com.tr > 97.100.123.37.salay.com.tr: ICMP echo reply, id 33605, seq 608, length 64
13:18:25.274353 IP 97.100.123.37.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 33605, seq 609, length 64
13:18:25.274373 IP 98.100.123.37.salay.com.tr > 97.100.123.37.salay.com.tr: ICMP echo reply, id 33605, seq 609, length 64
13:18:26.275483 IP 97.100.123.37.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 33605, seq 610, length 64
13:18:26.275505 IP 98.100.123.37.salay.com.tr > 97.100.123.37.salay.com.tr: ICMP echo reply, id 33605, seq 610, length 64
13:18:26.775694 IP 78.186.179.127.static.ttnet.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 1, seq 2672, length 40
13:18:27.276419 IP 97.100.123.37.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 33605, seq 611, length 64
13:18:27.276440 IP 98.100.123.37.salay.com.tr > 97.100.123.37.salay.com.tr: ICMP echo reply, id 33605, seq 611, length 64
13:18:28.277359 IP 97.100.123.37.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 33605, seq 612, length 64
13:18:28.277381 IP 98.100.123.37.salay.com.tr > 97.100.123.37.salay.com.tr: ICMP echo reply, id 33605, seq 612, length 64
13:18:29.114836 IP 26.156.9.185.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 14, seq 31501, length 40
13:18:29.278410 IP 97.100.123.37.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 33605, seq 613, length 64
13:18:29.278432 IP 98.100.123.37.salay.com.tr > 97.100.123.37.salay.com.tr: ICMP echo reply, id 33605, seq 613, length 64
13:18:30.279374 IP 97.100.123.37.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 33605, seq 614, length 64
13:18:30.279397 IP 98.100.123.37.salay.com.tr > 97.100.123.37.salay.com.tr: ICMP echo reply, id 33605, seq 614, length 64
13:18:31.280402 IP 97.100.123.37.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 33605, seq 615, length 64
13:18:31.280423 IP 98.100.123.37.salay.com.tr > 97.100.123.37.salay.com.tr: ICMP echo reply, id 33605, seq 615, length 64
13:18:31.777473 IP 78.186.179.127.static.ttnet.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 1, seq 2673, length 40
13:18:32.281568 IP 97.100.123.37.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 33605, seq 616, length 64
13:18:32.281590 IP 98.100.123.37.salay.com.tr > 97.100.123.37.salay.com.tr: ICMP echo reply, id 33605, seq 616, length 64
13:18:33.283300 IP 97.100.123.37.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 33605, seq 617, length 64
13:18:33.283321 IP 98.100.123.37.salay.com.tr > 97.100.123.37.salay.com.tr: ICMP echo reply, id 33605, seq 617, length 64
13:18:34.109379 IP 26.156.9.185.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 14, seq 31502, length 40
13:18:34.284346 IP 97.100.123.37.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 33605, seq 618, length 64
13:18:34.284368 IP 98.100.123.37.salay.com.tr > 97.100.123.37.salay.com.tr: ICMP echo reply, id 33605, seq 618, length 64
13:18:35.285438 IP 97.100.123.37.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 33605, seq 619, length 64
13:18:35.285456 IP 98.100.123.37.salay.com.tr > 97.100.123.37.salay.com.tr: ICMP echo reply, id 33605, seq 619, length 64
13:18:36.287278 IP 97.100.123.37.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 33605, seq 620, length 64
13:18:36.287299 IP 98.100.123.37.salay.com.tr > 97.100.123.37.salay.com.tr: ICMP echo reply, id 33605, seq 620, length 64
13:18:36.775740 IP 78.186.179.127.static.ttnet.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 1, seq 2674, length 40
13:18:37.288610 IP 97.100.123.37.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 33605, seq 621, length 64
13:18:37.288632 IP 98.100.123.37.salay.com.tr > 97.100.123.37.salay.com.tr: ICMP echo reply, id 33605, seq 621, length 64
13:18:38.289272 IP 97.100.123.37.salay.com.tr > 98.100.123.37.salay.com.tr: ICMP echo request, id 33605, seq 622, length 64
13:18:38.289293 IP 98.100.123.37.salay.com.tr > 97.100.123.37.salay.com.tr: ICMP echo reply, id 33605, seq 622, length 64
^C
48 packets captured
48 packets received by filter
0 packets dropped by kernel
[root@249 network-scripts]#
[root@249 network-scripts]#
[root@249 network-scripts]# ifconfig
em1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 185.9.159.249  netmask 255.255.255.0  broadcast 185.9.159.255
        inet6 fe80::d6ae:52ff:fe73:47d0  prefixlen 64  scopeid 0x20<link>
        ether d4:ae:52:73:47:d0  txqueuelen 1000  (Ethernet)
        RX packets 90238  bytes 7317534 (6.9 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 3254  bytes 677158 (661.2 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

em2: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether d4:ae:52:73:47:d1  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 0  (Local Loopback)
        RX packets 1  bytes 276 (276.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1  bytes 276 (276.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

p1p1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 37.123.100.98  netmask 255.255.255.248  broadcast 37.123.100.103
        inet6 fe80::a236:9fff:fe55:7ca8  prefixlen 64  scopeid 0x20<link>
        ether a0:36:9f:55:7c:a8  txqueuelen 1000  (Ethernet)
        RX packets 2275  bytes 198029 (193.3 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 396  bytes 37624 (36.7 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

p1p2: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.255.255.2  netmask 255.255.255.248  broadcast 10.255.255.7
        inet6 fe80::a236:9fff:fe55:7caa  prefixlen 64  scopeid 0x20<link>
        ether a0:36:9f:55:7c:aa  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 12  bytes 864 (864.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Open in new window

0
Duncan RoeSoftware DeveloperCommented:
Because when i redirect the traffic to the em1 interface it works. What now works for you that didn't work before?

I could not see 37.123.100.97 in your dump. But I could see 97.100.123.37 - I assume you meant that but please try to be more accurate next time.
I do see 26.156.9.185 failing to get an ICMP echo reply from 98.100.123.37.
Please do what I asked in http:#a40944970
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Linux

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.