iptables is like alchemy

[Bill Davidsen]

Jorge Fábregas wrote:
> Ok, I've posted a similar setup I've used in the past that worked like a
> charm.  The script is the actual /etc/sysconfig/iptables.  You'll notice
> the syntax there is somehow different than when you manually create the
> rules (or put in a script) but you get the idea.  Those rules WERE THE
> MINIMUM required in order to let a machine on internet reach a machine
> on the internal network (port 8,555).   Ask me any question if you don't
> understand a line (please specify line number in question).
>
> eth0 is WAN, eth1 is LAN.  Notice how I use "-i" and "-o" for the NICs.
>
> http://fpaste.org/sdPF/
>
I run very similar to this for my firewall, other than having two ISP 
connections and having to load balance outgoing sockets in a strange way (some 
clients accept only from one IP or another).

At this point tcpdump is your friend. I would be suspicious that the issue is 
rule 8 you posted, but without the IP of all machines I can't be sure. You don't 
note if the machine with failing DNS is using internal, external or both IPs, or 
at least it's not totally clear to me. Your "Server2" is only on the external 
net, so I presume that the IP is external.

In rule 8 you posted, I'm suspicious that something bizarre is happening, so you 
might try blocking your firewall internal IP[1] or limit MASQ to connections you 
initiate[2].
[1]  ! -s ${my_internal_IP}
[2]  -m state --state NEW
Just feels as if that is the isue, but tcpdump on the external side will tell 
you what's happening if neither of those things change the problem.
>
> HTH,
> Jorge
>


-- 
Bill Davidsen <davidsen at tmr.com>
   "We have more to fear from the bungling of the incompetent than from
the machinations of the wicked."  - from Slashdot