Few websites are not reachable using Linux gateway

Silkograph asked:

We have a LAN and Linux Box is used as Internet gateway.
On this gateway, we have installed intranet mail server (sendmail), fetchmail, proxy and dns.
Leased line is connected to this gateway and static IP is configured on this box.

From last 10-15 days it has been noticed that few of the websites are not working at all.
If I configure this same connection and IP to a standalone Windows PC all these website can be accessed without any problem.

I can not browse few sites and cannot ping thme but I can resolve address using nslookup.

My LAN configuration is as follows

ifconfig:

enp2s0: flags=4419<UP,BROADCAST,RUNNING,PROMISC,MULTICAST>  mtu 1500
        inet 192.168.1.41  netmask 255.255.255.0  broadcast 192.168.1.255
        inet6 fe80::52e5:49ff:fe1b:daa8  prefixlen 64  scopeid 0x20<link>
        ether 00:00:00:00:00:00  txqueuelen 1000  (Ethernet)
        RX packets 67331121  bytes 8458827280 (7.8 GiB)
        RX errors 0  dropped 2138  overruns 0  frame 0
        TX packets 66307928  bytes 58607952676 (54.5 GiB)
        TX errors 0  dropped 0 overruns 0  carrier 1  collisions 0

enp4s1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet XX.XXX.XXXX.XX  netmask 255.0.0.0  broadcast 49.255.255.255
        ether 00:00:00:00:00:00  txqueuelen 1000  (Ethernet)
        RX packets 66015747  bytes 58276418282 (54.2 GiB)
        RX errors 0  dropped 100  overruns 0  frame 0
        TX packets 53457822  bytes 7049917031 (6.5 GiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

/etc/resolve.conf

nameserver 8.8.8.8
nameserver 192.168.1.41

iptables

# Generated by iptables-save v1.4.21 on Fri Aug 12 10:18:54 2016
*filter
:INPUT ACCEPT [6409479:525988637]
:FORWARD ACCEPT [26036553:16397355271]
:OUTPUT ACCEPT [6914932:970229461]
-A INPUT -i eth0 -j LOG --log-prefix "BANDWIDTH_IN:" --log-level 7
-A FORWARD -o eth0 -j LOG --log-prefix "BANDWIDTH_OUT:" --log-level 7
-A FORWARD -i eth0 -j LOG --log-prefix "BANDWIDTH_IN:" --log-level 7
-A OUTPUT -o eth0 -j LOG --log-prefix "BANDWIDTH_OUT:" --log-level 7
COMMIT
# Completed on Fri Aug 12 10:18:54 2016
# Generated by iptables-save v1.4.21 on Fri Aug 12 10:18:54 2016
*nat
:PREROUTING ACCEPT [1480942:133895346]
:INPUT ACCEPT [179896:21387703]
:OUTPUT ACCEPT [82634:5613521]
:POSTROUTING ACCEPT [231368:13257122]
-A PREROUTING -d XX.XXX.XXX.XX/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.1.250
-A POSTROUTING -s 192.168.1.132/32 -j MASQUERADE
-A POSTROUTING -s 192.168.1.127/32 -j MASQUERADE
-A POSTROUTING -s 192.168.1.188/32 -j MASQUERADE
-A POSTROUTING -s 192.168.1.199/32 -j MASQUERADE
-A POSTROUTING -s 192.168.1.20/32 -j MASQUERADE
-A POSTROUTING -s 192.168.1.181/32 -j MASQUERADE
-A POSTROUTING -s 192.168.1.233/32 -j MASQUERADE
-A POSTROUTING -s 192.168.1.77/32 -j MASQUERADE
-A POSTROUTING -s 192.168.1.134/32 -j MASQUERADE
-A POSTROUTING -s 192.168.1.113/32 -j MASQUERADE
-A POSTROUTING -s 192.168.1.19/32 -j MASQUERADE
-A POSTROUTING -s 192.168.1.20/32 -j MASQUERADE
-A POSTROUTING -s 192.168.1.197/32 -j MASQUERADE
-A POSTROUTING -s 192.168.1.198/32 -j MASQUERADE
-A POSTROUTING -s 192.168.1.9/32 -j MASQUERADE
-A POSTROUTING -s 192.168.1.5/32 -j MASQUERADE
-A POSTROUTING -s 192.168.1.119/32 -j MASQUERADE
-A POSTROUTING -s 192.168.1.1/32 -j MASQUERADE
-A POSTROUTING -s 192.168.1.98/32 -j MASQUERADE
-A POSTROUTING -s 192.168.1.182/32 -j MASQUERADE
-A POSTROUTING -s 192.168.1.40/32 -p tcp -m tcp --dport 21 -j MASQUERADE
-A POSTROUTING -s 192.168.1.134/32 -p tcp -m tcp --dport 21 -j MASQUERADE
-A POSTROUTING -s 192.168.1.181/32 -p tcp -m tcp --dport 21 -j MASQUERADE
-A POSTROUTING -s 192.168.1.181/32 -p tcp -m tcp --dport 21 -j MASQUERADE
-A POSTROUTING -s 192.168.1.98/32 -p tcp -m tcp --dport 21 -j MASQUERADE
-A POSTROUTING -s 192.168.1.177/32 -p tcp -m tcp --dport 443 -j MASQUERADE
-A POSTROUTING -s 192.168.1.89/32 -p tcp -m tcp --dport 443 -j MASQUERADE
-A POSTROUTING -s 192.168.1.129/32 -p tcp -m tcp --dport 21 -j MASQUERADE
-A POSTROUTING -s 192.168.1.66/32 -j MASQUERADE
-A POSTROUTING -s 192.168.1.250/32 -j MASQUERADE
COMMIT
# Completed on Fri Aug 12 10:18:54 2016
# Generated by iptables-save v1.4.21 on Fri Aug 12 10:18:54 2016
*mangle
:PREROUTING ACCEPT [33387672:17017857834]
:INPUT ACCEPT [6409479:525988637]
:FORWARD ACCEPT [26036554:16397355355]
:OUTPUT ACCEPT [6914932:970229461]
:POSTROUTING ACCEPT [32955572:17367734827]
COMMIT
# Completed on Fri Aug 12 10:18:54 2016

How should I find what is blocking these connections. What else should I check in Linux box.
Can somebody give a hint to resolve the issue? Anything else should I mention here?
Thanks in advance.

My answer:


The netmask is wrong on the enp4s1 (WAN) interface.

This system has configured an IP address of 49.x.x.x and a netmask of 255.0.0.0 (prefix /8). But this is not the netmask that your ISP gave you.

As a result, you will be unable to access almost all websites whose IP addresses also start with 49.

To resolve the problem, fix the netmask or prefix declaration in your network configuration. I would expect the correct prefix to be somewhere in the vicinity of 27, 28 or 29, depending on the ISP.


View the full question and answer on Server Fault.

Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.