iptables port forwarding fails when adding third NIC (r8169) Kernel: 2.6.17-1.2174_fC5

Greeting,

I am experiencing a problem that defies all logic, and I'm hoping you
all can, perhaps, shed some light on the issue.

BACKGROUND:

I have a fairly standard data center setup: I have a FC5 Linux box
running iptables that acts as my firewall (responding to multiple IP
addresses) that masquerades for a number of services on multiple
machines in the private network. It also accepts local HTTP traffic
which an instance of Apache (running on the firewall) responds to and
then load balances by forwarding on to multiple servers in the private
network.

The internal interface is eth0 (marked as LAN1 on the box) and the
external is eth1 (marked as LAN2), and it works -- it's in production
now and everything is peachy.

THE PROBLEM:

I want to add a dmz. I purchased a network card (r8169), brought the
server down, installed the card, and started it back up. When it
booted, the r8169 claimed itself to be eth0, the LAN1 port claimed
eth1, and the LAN2 port claimed eth2.

No problem. I changed the cabling to accomodate. I plugged the LAN1
(eth2) into my dmz. I verified connectivity. I can ping my machines
in my dmz. I can ping my machines in my private network. I can ping
my upstream router. I can login to a machine on my dmz and access the
Internet (so I know my masquerading rules are correct, and the firewall
is routing properly).

HOWEVER, as soon as I added the r8169, all my INCOMING iptables
forwarding rules stopped working. I can still hit my web site (which
is being handled by a local process on the firewall), but I cannot hit
ANY services which are handled by the iptables FORWARD rule.

Keep in mind that I did not change any firewall rules. All I did was
put in a third NIC and changed the cabling. Like I said, I verified
connectivity by pinging several machines from each interface. But, all
my FORWARD rules ceased.

Additionally, my firewall is set up to log all dropped packets, and
although some packets are dropped, they are NOT the services I am
trying to access (they were legitimately dropped).

I cannot access ANY service that requires a port-forward.

I bring the server down, take out the card, start the server, put the
cabling back into it's original position, and everything works great
(sans dmz).

uname -a reports:
Linux xxx.com 2.6.17-1.2174_FC5 #1 Tue Aug 8 15:30:55 EDT 2006 i686
i686 i386 GNU/Linux

Any thoughts? Anyone?

Paul

.

Relevant Pages

  • Re: Unable to join AD domain from DMZ network
    ... To me that points to something outside the machine (Firewall most likely culprit) ... > the captured traffic between the server in DMZ to the DC from internal ... >>> authentication from DMZ to 2003 AD internal network. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Clients unable to access secure websites
    ... Also, double-check for firewall issues - for example, could the non-working machines have a 3rd party firewall like zone alarm or something that's packaged with the AV? ... In trying to research this, firewall seems to be a primary cause of TLS failures. ... > Installed an SBS 2003 R2 server in a company with a mixture of new and> all ...
    (microsoft.public.windows.server.sbs)
  • Re: 2 PCs not visible in net view or network browsing - Why?
    ... >> And they all specify the same WINS server? ... > unixoid dedicated machine serving as firewall.. ... >> Between the working machines ... >> Domain Master Browser. ...
    (microsoft.public.win2000.networking)
  • Re: Member Server Login Slow DMZ-Internal Subnet
    ... But did I mention that the firewall log showed a successful port 53 ... connection to each DC from the DMZ machine? ... the DMZ machine is the closest AD DC DNS. ... Member Server which was originally installed in the internal subnet ...
    (microsoft.public.win2000.security)
  • Re: Server hacked/being used as spammers haven...
    ... Given it's position in the dmz and not sure what firewall has been protecting it, your best bet is to have someone review the box in detail. ... The DMZ is not a protected area, it allows ALL internet traffic to your server - and that's VERY BAD - you may as well have just connected it directly to the ineternet and put out a sign that says FREE SERVER - HACK HERE. ... No, you need a real firewall, and then go with a single NIC and then you can VPN into the firewall itself, then create rules in the firewall that allow access to the network. ...
    (microsoft.public.windows.server.sbs)
Loading