[Solved] Win7 Can't Access Some Sites Behind Gentoo Router

solamour · Last edited by solamour on Sat May 05, 2012 6:19 am; edited 1 time in total

I think I'm asking in a wrong forum, but I have a hunch I might be able to get some useful guides from gentoo experts, so here it is.

I have a simple gentoo box acting as a router. A bunch of boxes are sharing Internet connection through gentoo, and gentoo is running Shorewall (firewall).

cach0rr0 · Posted: Fri May 04, 2012 8:08 am Post subject:

a few random shots in the dark, for whatever that's worth:

-IPV6
-MTU problem

Those are the two things that spring to mind that would be added/removed from the picture based on going through a proxy or not
start with DNS lookups from the Win7 box, maybe a packet cap, see if it's trying to connect to an IPV6 address
_________________
Lost configuring your system?
dump lspci -n here | see Pappy's guide | Link Stash

solamour · Posted: Fri May 04, 2012 8:30 pm Post subject:

I thought about IPv6, but other than checking it off in Win7, I'm not sure what I can do about it.

I read something about MTU, but messing with it didn't make much difference, possibly because I wasn't doing it right.

Just to make sure I'm not missing anything, brought the Win7 laptop to work and verified everything worked as expected. But when I bring the laptop home, and it wouldn't load certain sites.

Frankly I really don't care too much about the troubling sites, because I don't go there often enough to bother me, and when I need to, I can always use the web proxy server in Gentoo router. But it's still puzzling, and I'm not sure I'd feel good about it.
__
sol

Hu · Administrator Joined: 06 Mar 2007 Posts: 23101

What is the output of ip a on the Gentoo machine? Blank the public IP address if you want. I want to see the interface properties, rather than their actual addresses. Have you checked a packet capture of the Windows 7 machine accessing the problematic site versus an internal Linux machine (not the Gentoo router) accessing that same site successfully?

PaulBredbury · Watchman Joined: 14 Jul 2005 Posts: 7310

solamour · Posted: Sat May 05, 2012 5:23 am Post subject:

Here is the output of "ip a".

PaulBredbury · Watchman Joined: 14 Jul 2005 Posts: 7310

Check the MTU that Windows 7 is using. I'm sure you can google as to how.

solamour · Posted: Sat May 05, 2012 6:18 am Post subject:

Changing MTU of gentoo's eth0 from 576 to 1500 fixed the problem. Not sure why it was set to 576, because I don't remember doing it.

PaulBredbury · Watchman Joined: 14 Jul 2005 Posts: 7310

Probably your dhcp changes it.

solamour · Posted: Sat May 05, 2012 7:54 am Post subject:

Indeed. I noticed that gentoo's MTU was changed back to 576 automatically, and when I commented out "option interface_mtu" in "/etc/dhcpcd.conf", the value has been staying as is so far. Thanks for the help.
__
sol

cach0rr0 · Posted: Sat May 05, 2012 9:00 am Post subject:

Hu · Administrator Joined: 06 Mar 2007 Posts: 23101

I wanted to see the network capture as done by the Gentoo router, but with clients running on the working and non-working internal systems.

With regard to the MTU, I have encountered DHCP servers that suggest the minimum MTU to the DHCP client, even when, as in this case, a more common MTU of 1500 works at least as well, if not better. These servers are usually operated by individuals who are unaware that their server is wrong, unable to fix it, or uninterested in fixing it. Advertising an unnecessarily low MTU is bad practice, so anyone who can fix their server to advertise the proper MTU should do so. In my opinion, anyone who runs a DHCP server exposed to end users should know that this is bad practice and should have fixed it before the end users ever discovered the bad advertisement. As described in WP: MTU, there are some situations where advertising a smaller MTU is better, but I doubt that any of those justifications apply here.

solamour · Posted: Sun May 06, 2012 6:41 am Post subject:

When I ran Wireshark on Windows 7 to capture data, I noticed that with gentoo box's MTU set 576, a lot of "Time-to-live exceeded (Fragment reassembly time exceeded)" were in the log. With 1500, everything went through smoothly. Perhaps that might be the cause some sites load properly while some others don't.

I'd share the network capture from the gentoo router, if someone shows me how to do so. The gentoo box doesn't have the graphical interface, so I need to use a console-based tool.
__
sol

cach0rr0 · Posted: Sun May 06, 2012 8:31 am Post subject:

solamour · Posted: Mon May 07, 2012 8:34 am Post subject:

Not sure it's safe to share the capture files with the world (let me know if that's not the case), but in the name of experiment, here they are. The captures were done from the gentoo box using tcpdump.

http://dl.dropbox.com/u/9810590/mtu1500_good.pcap
http://dl.dropbox.com/u/9810590/mtu576_bad.pcap

I see a lot of texts in red color entries when I open "mtu576_bad.pcap" in Wireshark, which, I believe, is not a good sign. Anyhow, I now know what the problem is and how to solve it. The troubling web sites are loading blazingly fast. Thank you all.
__
sol