Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 2 down vote favorite

I have a server with forwarding turned on. I placed an iptables LOG target in the PREROUTING, INPUT, and FORWARD chains of the mangle table. I can see the LOG messages from PREROUTING, but not INPUT or FORWARD. I have no iptables rules other than the logging. Why does the packet not get past the PREROUTING chain?

From various netfilter charts, it seems that the only thing that can stop it is the routing decision. I have checked that forwarding is turned on, I don't have any special routing policies setup, and I do have a route to the packet's destination. Reverse path filtering is disabled.

One netfilter chart suggests the packet goes through QOS ingress at that point. I'm not too familiar with QOS, but I've not done anything special with tc. My qdiscs are pfifo_fast (the default), and there are no filters.

Additional details: This is an IPsec tunnel endpoint. The packets are coming in through IPsec, getting transformed successfully, and re-entering the networking stack. It is at this stage that I see the packet get stopped after PREROUTING before either INPUT or FORWARD.

share|improve this question
Can you add some more details about the networking setup? Have you already checked reverse path filtering isn't the problem? – polynomial Aug 31 '11 at 19:59
I added extra details to the question. rp_filtering is disabled. If I enable it and turn on log_martians, they show up in the syslog. Disabling rp_filtering again stops them from being logged as such. – Shawn J. Goff Aug 31 '11 at 20:32
do you have any type of analysis took like wireshark to see where they are going and where they are not? – Jim Aug 31 '11 at 21:10
Wireshark actually provides less insight than iptables LOGs in this case. It sees the packet before netfilter; we already know it's getting past that point because it is passing through certain netfilter hooks. – Shawn J. Goff Aug 31 '11 at 21:29
What matches did you supply with the LOG target? What are the tunnel end points. Which routes are set? What is the ip l, ip r and ip a output? – artistoex Nov 19 '11 at 13:37
show 1 more comment

closed as too localized by Shawn J. Goff, Michael Mrozek♦ Feb 15 '12 at 21:22

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, see the FAQ.