[РЕШЕНО] ppp0 блокирует пакеты

lisz 15 мая, 2012 - 11:48

Системное администрирование

Доброго дня.
Есть два интернет-шлюза на Генту.
Машины абсолютно идентичные кроме того, что у одного статический ip провайдера (на eth1), а другой поднимает pppoe (ppp0).
С тем у которого статика проблем нет, а вот второй сервер почему-то не загружает некоторые страницы и файлы. Даже гугл не могу открыть, а вот яндекс открывает.
Интернет он раздает через iptables (MASQUERADING)
Почему ppp0 (или iptables) блокирует эти пакеты?

route2 ~ # uname -a
Linux route2 2.6.32.18 #18 SMP Sun Jan 16 19:27:47 MSK 2011 x86_64 Intel(R) Core(TM) i5-2310 CPU @ 2.90GHz GenuineIntel GNU/Linux

route2 ~ # cat /etc/conf.d/net.ppp0

config_eth0=( "null" )
config_eth1=( "null" )
config_eth2=( "null" )
config_eth0=( "null" )

config_ppp0=( "ppp" )
link_ppp0="eth1"
plugins_ppp0=( "pppoe" )

username_ppp0='M480498'
password_ppp0='*******'

pppd_ppp0=(

    "noauth"
    "defaultroute"
    "default-asyncmap"
    "usepeerdns"
    "ipcp-accept-remote"
    "ipcp-accept-local"
    "lcp-echo-interval 15"
    "lcp-echo-failure 3"
    "mru 1492"
    "mtu 1492"
    "debug"
)

route2 ~ # ifconfig ppp0
ppp0      Link encap:Point-to-Point Protocol
          inet addr:91.225.10.203  P-t-P:10.16.255.136  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1492  Metric:1
          RX packets:2180 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2396 errors:0 dropped:11 overruns:0 carrier:0
          collisions:0 txqueuelen:3
          RX bytes:393954 (384.7 KiB)  TX bytes:325442 (317.8 KiB)

route2 ~ # iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i tap+ -j ACCEPT
-A INPUT -i xenbr0 -j ACCEPT
-A INPUT -d 127.0.0.1/32 -j ACCEPT
-A INPUT -i xenbr0 -j ACCEPT
-A INPUT -s 192.168.2.0/24 -j ACCEPT
-A INPUT -s 192.168.2.0/24 -m state --state NEW -j ACCEPT
-A INPUT -s 192.168.2.0/24 -p tcp -j ACCEPT
-A INPUT -s 192.168.2.0/24 -p udp -j ACCEPT
-A INPUT -p tcp -m tcp --dport 2049 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-A INPUT -p tcp -m tcp --dport 111 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-A INPUT -p udp -m udp --dport 2049 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 111 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 10001 -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 995 -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 587 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.0.0/16 -d 192.168.0.0/16 -j ACCEPT
-A FORWARD -d 78.138.135.10/32 -j ACCEPT
-A FORWARD -d 78.138.154.10/32 -j ACCEPT
-A FORWARD -j ACCEPT
-A FORWARD -i xenbr0 -o xenbr0 -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o xenbr0 -j ACCEPT

route2 ~ # iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             localhost
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  192.168.6.0/24       anywhere
ACCEPT     all  --  192.168.6.0/24       anywhere            state NEW
ACCEPT     tcp  --  192.168.6.0/24       anywhere
ACCEPT     udp  --  192.168.6.0/24       anywhere
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:nfs flags:FIN,SYN,RST,ACK/SYN
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:sunrpc flags:FIN,SYN,RST,ACK/SYN
ACCEPT     udp  --  anywhere             anywhere            udp dpt:nfs
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:sunrpc flags:SYN,RST,ACK/SYN

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:10001
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pop3s
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:submission
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     all  --  192.168.0.0/16       192.168.0.0/16
ACCEPT     all  --  anywhere             ns.kgts.ru
ACCEPT     all  --  anywhere             ns2.kgts.ru
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere

route2 ~ # iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  192.168.2.0/24       anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination