From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S267702AbUGWNZY (ORCPT ); Fri, 23 Jul 2004 09:25:24 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S267711AbUGWNZY (ORCPT ); Fri, 23 Jul 2004 09:25:24 -0400 Received: from out006pub.verizon.net ([206.46.170.106]:10389 "EHLO out006.verizon.net") by vger.kernel.org with ESMTP id S267702AbUGWNZO (ORCPT ); Fri, 23 Jul 2004 09:25:14 -0400 From: Gene Heskett Organization: Organization: undetectable To: linux-kernel@vger.kernel.org Subject: Re: changing ethernet devices, new one stops cold at iptables Date: Fri, 23 Jul 2004 09:25:13 -0400 User-Agent: KMail/1.6 References: <200407222114.20301.gene.heskett@verizon.net> <4100F2F0.3080300@redhat.com> In-Reply-To: <4100F2F0.3080300@redhat.com> MIME-Version: 1.0 Content-Disposition: inline Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Message-Id: <200407230925.13565.gene.heskett@verizon.net> X-Authentication-Info: Submitted using SMTP AUTH at out006.verizon.net from [141.153.92.37] at Fri, 23 Jul 2004 08:25:13 -0500 Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org On Friday 23 July 2004 07:13, Neil Horman wrote: >Gene Heskett wrote: [...] >> One thing I haven't tried is to reset the MAC address for the >> nforce2 ethernet to match the D-Links hardware address. Is it >> worth a try just to prove the point? > >I'd think so. Its a two minute test to verify that the problem is >related to the MAC address of nic in the firewall. You may also > want to add a LOG target to all the chains in your firewall to > match on the origional MAC address so you can see what your > iptables code is doing with the packet. > >HTH >Neil ok, rebooted ignored the kudzu stuff about the old 8139too, fired up x and used redhat-config-network to deactive both (which now had the same MAC address) and rebuilt a new eth0 using the relabeled forcedeth driver, moved the cable and restarted the network. It all works. So, lemme go get the /etc/sysconfig/iptables file and include it, because I cannot see anything that makes use of the MAC address in any of it. As you can see from the accounting, lots of data has moved. ------------------ # Generated by iptables-save v1.2.7a on Tue May 18 11:20:01 2004 *mangle :PREROUTING ACCEPT [202871737:120105858881] :INPUT ACCEPT [139048151:73020278748] :FORWARD ACCEPT [46936292:35515502787] :OUTPUT ACCEPT [154434852:126073464036] :POSTROUTING ACCEPT [188592053:156100678907] COMMIT # Completed on Tue May 18 11:20:01 2004 # Generated by iptables-save v1.2.7a on Tue May 18 11:20:01 2004 *nat :PREROUTING ACCEPT [1095914:117590573] :POSTROUTING ACCEPT [506424:54549861] :OUTPUT ACCEPT [506316:54543401] [458696:27814663] -A POSTROUTING -s 192.168.71.3 -o eth0 -j MASQUERADE # [] -A POSTROUTING -s 192.168.71.4 -o eth0 -j MASQUERADE COMMIT # Completed on Tue May 18 11:20:01 2004 # Generated by iptables-save v1.2.7a on Tue May 18 11:20:01 2004 *filter :INPUT ACCEPT [764513:261233004] :FORWARD ACCEPT [899862:777851140] :OUTPUT ACCEPT [67156239:19633863841] [152090648:81083207296] -A INPUT -i eth1 -j ACCEPT [2813341:3132361045] -A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT [174681:55726580] -A INPUT -i lo -j ACCEPT [0:0] -I INPUT -p tcp --destination-port 6881:6889 -j ACCEPT # [0:0] -A INPUT -p tcp -m state --state NEW -m tcp --dport 6881:6999 -j ACCEPT [336:50753] -A INPUT -p tcp -m state --state NEW -m tcp ! --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "New not syn: " [336:50753] -A INPUT -p tcp -m state --state NEW -m tcp ! --tcp-flags SYN,RST,ACK SYN -j DROP [13478612:872497237] -A FORWARD -i eth1 -o eth0 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT [26626623:33286598582] -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT [87041832:106421017831] -A OUTPUT -o eth1 -j ACCEPT [521:17036] -A OUTPUT -p icmp -m state --state INVALID -j DROP [232781:18324718] -A OUTPUT -o eth0 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT COMMIT # Completed on Tue May 18 11:20:01 2004 --------------------- The BitTorrent stuff didn't work :(, but I've not removed it... Probhably something in the router, a linksys BEFSR41 w/latest flash. If there is nothing above thats responsible, then it seems to me it has to be arp related. I've just now started studying the manpages there, and I'm not too sure what I need to do there in order to restore full function to the new MAC address if and when I put it back to something nvidia related. Pointers welcome in any case. -- Cheers, Gene There are 4 boxes to be used in defense of liberty. Soap, ballot, jury, and ammo. Please use in that order, starting now. -Ed Howdershelt, Author Additions to this message made by Gene Heskett are Copyright 2004, Maurice E. Heskett, all rights reserved.