iptables sporadic "sendmsg: operation not permitted" problem and packet loss

DISCUSSION Dennis Jacobfeuerborn 4 participants 4 messages Mar 7, 2009 – Mar 9, 2009

Share & tools

Dennis Jacobfeuerborn

author

2009-03-07 21:33 UTC #0 lore raw

Hi,

I'm running into a problem on a machine that right now acts as a simple gateway but is supposed to become a firewall too. When I start iptables using "/etc/init.d/iptables start" on the Centos 5.2 machine first everything works fine but after about 30 seconds I'm seeing packet loss and running a ping outputs "sendmsg: operation not permitted" sporadically. The moment I stop iptables again everything returns to normal. What is consufing to me is that I don't even have any rules defined so far. This is what my "/etc/sysconfig/iptables" file looks like:

# Generated by iptables-save v1.3.5 on Thu Mar 5 17:40:28 2009 *filter
:INPUT ACCEPT [26715202:4750206096]
:FORWARD ACCEPT [1382646771:1563210213960]
:OUTPUT ACCEPT [22930985:6256734041]
COMMIT

iptables -L says:

Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Does anyone have an idea why that would have such a severe impact on the traffic? The fact that it takes a moment for the problems to show up makes me suspect some kind of buffer issue so that the packet loss only begins to occur after some buffer begins to overflow. That just a guess though and I have no idea what buffer that could be.

Regards,
Dennis

Gáspár Lajos

2009-03-09 13:33 UTC #1 lore raw

Dennis Jacobfeuerborn írta:

Quoted 20 lines

Hi,
I'm running into a problem on a machine that right now acts as a simple gateway but is supposed to become a firewall too. When I start iptables using "/etc/init.d/iptables start" on the Centos 5.2 machine first everything works fine but after about 30 seconds I'm seeing packet loss and running a ping outputs "sendmsg: operation not permitted" sporadically. The moment I stop iptables again everything returns to normal. What is consufing to me is that I don't even have any rules defined so far. This is what my "/etc/sysconfig/iptables" file looks like:
# Generated by iptables-save v1.3.5 on Thu Mar 5 17:40:28 2009 *filter
:INPUT ACCEPT [26715202:4750206096]
:FORWARD ACCEPT [1382646771:1563210213960]
:OUTPUT ACCEPT [22930985:6256734041]
COMMIT
iptables -L says:
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination

Quoted 8 lines

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Does anyone have an idea why that would have such a severe impact on the traffic? The fact that it takes a moment for the problems to show up makes me suspect some kind of buffer issue so that the packet loss only begins to occur after some buffer begins to overflow. That just a guess though and I have no idea what buffer that could be.
Regards,
Dennis

Hi Dennis,

What about the other tables?

iptables -vnL -t raw
iptables -vnL -t mangle
iptables -vnL -t nat

Swifty

Dennis J.

2009-03-09 15:11 UTC #2 lore raw

Quoted 41 lines · Gáspár Lajos

Dennis Jacobfeuerborn írta:
Quoted 30 lines
Hi,
I'm running into a problem on a machine that right now acts as a simple gateway but is supposed to become a firewall too. When I start iptables using "/etc/init.d/iptables start" on the Centos 5.2 machine first everything works fine but after about 30 seconds I'm seeing packet loss and running a ping outputs "sendmsg: operation not permitted" sporadically.
The moment I stop iptables again everything returns to normal. What is consufing to me is that I don't even have any rules defined so far. This is what my "/etc/sysconfig/iptables" file looks like:
# Generated by iptables-save v1.3.5 on Thu Mar 5 17:40:28 2009 *filter
:INPUT ACCEPT [26715202:4750206096]
:FORWARD ACCEPT [1382646771:1563210213960]
:OUTPUT ACCEPT [22930985:6256734041]
COMMIT
iptables -L says:
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Quoted 9 lines
Does anyone have an idea why that would have such a severe impact on the traffic? The fact that it takes a moment for the problems to show up makes me suspect some kind of buffer issue so that the packet loss only begins to occur after some buffer begins to overflow. That just a guess though and I have no idea what buffer that could be.
Regards,
Dennis

Quoted 7 lines

Hi Dennis,
What about the other tables?
iptables -vnL -t raw
iptables -vnL -t mangle
iptables -vnL -t nat

All clear:

[root@gw ~]# iptables -vnL -t raw
Chain PREROUTING (policy ACCEPT 132 packets, 77370 bytes)
pkts bytes target prot opt in out source
destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination

[root@gw ~]# iptables -vnL -t mangle
Chain PREROUTING (policy ACCEPT 2688M packets, 1487G bytes)
pkts bytes target prot opt in out source
destination

Chain INPUT (policy ACCEPT 2048K packets, 368M bytes)
pkts bytes target prot opt in out source
destination

Chain FORWARD (policy ACCEPT 2686M packets, 1486G bytes)
pkts bytes target prot opt in out source
destination

Chain OUTPUT (policy ACCEPT 1961K packets, 997M bytes)
pkts bytes target prot opt in out source
destination

Chain POSTROUTING (policy ACCEPT 2688M packets, 1487G bytes)
pkts bytes target prot opt in out source
destination

[root@gw ~]# iptables -vnL -t nat
Chain PREROUTING (policy ACCEPT 178 packets, 40798 bytes)
pkts bytes target prot opt in out source
destination

Chain POSTROUTING (policy ACCEPT 121 packets, 26962 bytes)
pkts bytes target prot opt in out source
destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination

Regards,
Dennis

Mart Frauenlob

2009-03-09 20:12 UTC #3 lore raw

In reply to Dennis Jacobfeuerborn

Quoted 20 lines · [email protected] wrote:

Hi,
I'm running into a problem on a machine that right now acts as a simple gateway but is supposed to become a firewall too. When I start iptables using "/etc/init.d/iptables start" on the Centos 5.2 machine first everything works fine but after about 30 seconds I'm seeing packet loss and running a ping outputs "sendmsg: operation not permitted" sporadically. The moment I stop iptables again everything returns to normal. What is consufing to me is that I don't even have any rules defined so far. This is what my "/etc/sysconfig/iptables" file looks like:
# Generated by iptables-save v1.3.5 on Thu Mar 5 17:40:28 2009 *filter
:INPUT ACCEPT [26715202:4750206096]
:FORWARD ACCEPT [1382646771:1563210213960]
:OUTPUT ACCEPT [22930985:6256734041]
COMMIT
iptables -L says:
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination

Quoted 8 lines

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Does anyone have an idea why that would have such a severe impact on the traffic? The fact that it takes a moment for the problems to show up makes me suspect some kind of buffer issue so that the packet loss only begins to occur after some buffer begins to overflow. That just a guess though and I have no idea what buffer that could be.
Regards,
Dennis

Hello,

sounds like something that happend to me, when I accidentally did set ip_conntrack_max to `1'. If you don't know where it's located do some like: find /proc/sys/net -name ip_conntrack_max

Maybe it's that issue, maybe not - just a guess.

Greets

Mart