[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

ipchains/firewall oddly blocking random websites

I have a bizarre problem that I am having trouble fixing.  I have a home
firewall running kernel 2.2.20 with ipchains.  For some odd reason, the
firewall blocks about 5% of the websites I try to go to.  I turned on
logging for my HTTP ipchains rules and nothing out of the ordinary seems
to be happening.  Here is the http portion of my rules:

# Allow HTTP access to remote web sites
ipchains -A output      -i $EXTERNAL_INTERFACE -p tcp \
          -s $IPADDR $UNPRIVPORTS \
          -d $ANYWHERE 80 -j ACCEPT
ipchains -A input       -i $EXTERNAL_INTERFACE -p tcp ! -y \
          -s $ANYWHERE 80 \
          -d $IPADDR $UNPRIVPORTS -j ACCEPT

# Allow HTTPS access to remote secure web sites
ipchains -A output      -i $EXTERNAL_INTERFACE -p tcp \
          -s $IPADDR $UNPRIVPORTS \
          -d $ANYWHERE 443 -j ACCEPT
ipchains -A input       -i $EXTERNAL_INTERFACE -p tcp ! -y \
          -s $ANYWHERE 443 \
          -d $IPADDR $UNPRIVPORTS -j ACCEPT

And here is how those variables are defined:
IPADDR="66.222.30.128"
EXTERNAL_INTERFACE="eth0"
ANYWHERE="any/0"
UNPRIVPORTS="1024:65535"

Furthermore, here is a sample log from a successful attempt to access
www.weather.com:

Feb 22 17:08:54 cortafuegos kernel: Packet log: output ACCEPT eth0
PROTO=6 66.222.30.128:62543 63.111.66.11:80 L=48 S=0x00 I=
64715 F=0x4000 T=127 SYN (#38)
Feb 22 17:08:54 cortafuegos kernel: Packet log: input ACCEPT eth0
PROTO=6 63.111.66.11:80 66.222.30.128:62543 L=48 S=0x00 I=0
 F=0x4000 T=51 (#89)
Feb 22 17:08:54 cortafuegos kernel: Packet log: output ACCEPT eth0
PROTO=6 66.222.30.128:62543 63.111.66.11:80 L=40 S=0x00 I=
64971 F=0x4000 T=127 (#38)
Feb 22 17:08:54 cortafuegos kernel: Packet log: output ACCEPT eth0
PROTO=6 66.222.30.128:62543 63.111.66.11:80 L=454 S=0x00 I
=65227 F=0x4000 T=127 (#38)
Feb 22 17:08:54 cortafuegos kernel: Packet log: input ACCEPT eth0
PROTO=6 63.111.66.11:80 66.222.30.128:62543 L=40 S=0x00 I=7
564 F=0x4000 T=51 (#89)
Feb 22 17:08:54 cortafuegos kernel: Packet log: input ACCEPT eth0
PROTO=6 63.111.66.11:80 66.222.30.128:62543 L=1500 S=0x00 I
=7565 F=0x4000 T=51 (#89)
Feb 22 17:08:54 cortafuegos kernel: Packet log: input ACCEPT eth0
PROTO=6 63.111.66.11:80 66.222.30.128:62543 L=1500 S=0x00 I
=7566 F=0x4000 T=51 (#89)
Feb 22 17:08:54 cortafuegos kernel: Packet log: output ACCEPT eth0
PROTO=6 66.222.30.128:62543 63.111.66.11:80 L=40 S=0x00 I=
65483 F=0x4000 T=127 (#38)
Feb 22 17:08:54 cortafuegos kernel: Packet log: input ACCEPT eth0
PROTO=6 63.111.66.11:80 66.222.30.128:62543 L=1500 S=0x00 I
=7567 F=0x4000 T=51 (#89)
Feb 22 17:08:54 cortafuegos kernel: Packet log: input ACCEPT eth0
PROTO=6 63.111.66.11:80 66.222.30.128:62543 L=1500 S=0x00 I
=7568 F=0x4000 T=51 (#89)
Feb 22 17:08:54 cortafuegos kernel: Packet log: output ACCEPT eth0
PROTO=6 66.222.30.128:62543 63.111.66.11:80 L=40 S=0x00 I=
204 F=0x4000 T=127 (#38)
Feb 22 17:08:54 cortafuegos kernel: Packet log: input ACCEPT eth0
PROTO=6 63.111.66.11:80 66.222.30.128:62543 L=1500 S=0x00 I
=7569 F=0x4000 T=51 (#89)
Feb 22 17:08:54 cortafuegos kernel: Packet log: input ACCEPT eth0
PROTO=6 63.111.66.11:80 66.222.30.128:62543 L=1500 S=0x00 I
=7570 F=0x4000 T=51 (#89)
Feb 22 17:08:54 cortafuegos kernel: Packet log: output ACCEPT eth0
PROTO=6 66.222.30.128:62543 63.111.66.11:80 L=40 S=0x00 I=
460 F=0x4000 T=127 (#38)
Feb 22 17:08:54 cortafuegos kernel: Packet log: input ACCEPT eth0
PROTO=6 63.111.66.11:80 66.222.30.128:62543 L=1500 S=0x00 I

And then, here is a sample log from a failed attempt to access
www.wunderground.com:

Feb 22 17:20:53 cortafuegos kernel: Packet log: output ACCEPT eth0
PROTO=6 66.222.30.128:62556 66.28.69.136:80 L=48 S=0x00 I=
20688 F=0x4000 T=127 SYN (#38)
Feb 22 17:20:56 cortafuegos kernel: Packet log: output ACCEPT eth0
PROTO=6 66.222.30.128:62556 66.28.69.136:80 L=48 S=0x00 I=
21200 F=0x4000 T=127 SYN (#38)
Feb 22 17:20:56 cortafuegos kernel: Packet log: input DENY eth0 PROTO=6
66.28.69.136:80 66.222.30.128:62556 L=48 S=0x00 I=627
80 F=0x4000 T=51 (#26)
Feb 22 17:20:59 cortafuegos kernel: Packet log: input DENY eth0 PROTO=6
66.28.69.136:80 66.222.30.128:62556 L=48 S=0x00 I=629
45 F=0x4000 T=51 (#26)
Feb 22 17:21:02 cortafuegos kernel: Packet log: output ACCEPT eth0
PROTO=6 66.222.30.128:62556 66.28.69.136:80 L=48 S=0x00 I=
22224 F=0x4000 T=127 SYN (#38)
Feb 22 17:21:02 cortafuegos kernel: Packet log: input DENY eth0 PROTO=6
66.28.69.136:80 66.222.30.128:62556 L=48 S=0x00 I=632
56 F=0x4000 T=51 (#26)
Feb 22 17:21:06 cortafuegos kernel: Packet log: input DENY eth0 PROTO=6
66.28.69.136:80 66.222.30.128:62556 L=48 S=0x00 I=637
68 F=0x4000 T=51 (#26)
Feb 22 17:21:14 cortafuegos kernel: Packet log: output ACCEPT eth0
PROTO=6 66.222.30.128:62556 66.28.69.136:80 L=48 S=0x00 I=
24272 F=0x4000 T=127 SYN (#38)
Feb 22 17:21:14 cortafuegos kernel: Packet log: input DENY eth0 PROTO=6
66.28.69.136:80 66.222.30.128:62556 L=48 S=0x00 I=644
17 F=0x4000 T=51 (#26)
Feb 22 17:21:18 cortafuegos kernel: Packet log: input DENY eth0 PROTO=6
66.28.69.136:80 66.222.30.128:62556 L=48 S=0x00 I=647
77 F=0x4000 T=51 (#26)
Feb 22 17:21:38 cortafuegos kernel: Packet log: output ACCEPT eth0
PROTO=6 66.222.30.128:62557 66.28.69.136:80 L=48 S=0x00 I=
30672 F=0x4000 T=127 SYN (#38)
Feb 22 17:21:38 cortafuegos kernel: Packet log: input DENY eth0 PROTO=6
66.28.69.136:80 66.222.30.128:62557 L=44 S=0x00 I=605
85 F=0x0000 T=51 (#26)
Feb 22 17:21:41 cortafuegos kernel: Packet log: output ACCEPT eth0
PROTO=6 66.222.30.128:62557 66.28.69.136:80 L=48 S=0x00 I=
31184 F=0x4000 T=127 SYN (#38)
Feb 22 17:21:41 cortafuegos kernel: Packet log: input DENY eth0 PROTO=6
66.28.69.136:80 66.222.30.128:62557 L=44 S=0x00 I=606
72 F=0x0000 T=51 (#26)
Feb 22 17:21:43 cortafuegos kernel: Packet log: input DENY eth0 PROTO=6
66.28.69.136:80 66.222.30.128:62556 L=48 S=0x00 I=162
0 F=0x4000 T=51 (#26)

Can anyone help me pinpoint my problem?  I am really scratching my head
on this one.

Thanks!
Bryan Walton
Reply to: