同样的环境,windows 可上网. linux不能.为啥?盼高人指点(有图~).

pulic

同样的环境,windows 可上网. linux不能.为啥?盼高人指点..

环境如下:
外网迁电信的网进户. 在电话线端用了一个路由器, 暂且称为路由器A

路由器A(192.168.1.1)下分成两个条线路.分别为一台PC ( 192.168.1.2)和一台路由器B(192.168.1.100)

在路由器B下面.有一台PC(192.168.10.100)　　　所以路由器B的wan口的ip为192.168.1.100.　lan口的ip为192.168.10.1

现在:192.168.10.100 的pc是windows的系统时.上网是正常的.

而当192.168.10.100　的ＰＣ为linux的系统是时却无法上网．状况是：可以ping通ＤＮＳ和192.168.1.1以及192.168.10.1.就是无法打开网页．．

当把192.168.10.100　的ＰＣ　放在路由器Ｂ的位置时．在linux的系统下，又是可以打开网页的．．
所以．对个问题有点疑惑．请达人给指点一下．谢谢．．．

大致网格拓扑图如下:

　　　　　　　　                  | ----- PC(192.168.1.2)
　　　　　　　         　         |
－－－－ADSL------－－路由器A-----|------路由器B---------------------PC(192.168.10.100)
                          (192.168.1.1)       B_wan (192.168.1.100)
                                                       B_lan (192.168.10.1)

ssffzz1

2种系统的IP 掩码 网关 DNS 设置帖出来

ssffzz1

还有LINUX的IPTABLES-SAVE

pulic

我用的是centos 5.3 (2.6.18-128.e15)
eth0的信息为:
# Broadcom Corporation NetLink BCM5906M Fast Ethernet PCI Express
DEVICE=eth0
BOOTPROTO=none
HWADDR=00:1B:38:9B:E2:EA
ONBOOT=yes
TYPE=Ethernet
USERCTL=yes
IPV6INIT=no
PEERDNS=yes
NETMASK=255.255.255.0
IPADDR=192.168.10.106
GATEWAY=192.168.10.1

resolv.conf的信息为:
search localdomain
nameserver 202.103.24.68

新装的系统.所以防火墙和SElinux都是处于禁用状态..

windows:下的配置为:
IP:192.168.10.110
MASK:255.255.255.0
GW:192.168.10.1
DNS:202.103.24.68

[ 本帖最后由 pulic 于 2009-5-17 12:20 编辑 ]

ssffzz1

帖
iptables-save
ifconfig -a
route

pulic

谢谢issffzz1 的关注．．结果如下：
fconfig -a

eth0      Link encap:Ethernet  HWaddr 00:1B:38:9B:E2:EA  
          inet addr:192.168.10.106  Bcast:192.168.10.255  Mask:255.255.255.0
          inet6 addr: fe80::21b:38ff:fe9b:e2ea/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:37 errors:0 dropped:0 overruns:0 frame:0
          TX packets:104 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:3974 (3.8 KiB)  TX bytes:12932 (12.6 KiB)
          Interrupt:193

eth1      Link encap:Ethernet  HWaddr 00:1A:73D9:CF  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)
          Interrupt:10 Base address:0x8000

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:1401 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1401 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:2388340 (2.2 MiB)  TX bytes:2388340 (2.2 MiB)

sit0      Link encap:IPv6-in-IPv4  
          NOARP  MTU:1480  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)
＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊
我不太明白这个如何查看iptables-save．所以我就把iptables -L -n  和　iptables-config给贴出来了．
iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination  

＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊

iptables-config

# Load additional iptables modules (nat helpers)
#   Default: -none-
# Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which
# are loaded after the firewall rules are applied. Options for the helpers are
# stored in /etc/modprobe.conf.
IPTABLES_MODULES="ip_conntrack_netbios_ns"

# Unload modules on restart and stop
#   Value: yes|no,  default: yes
# This option has to be 'yes' to get to a sane state for a firewall
# restart or stop. Only set to 'no' if there are problems unloading netfilter
# modules.
IPTABLES_MODULES_UNLOAD="yes"

# Save current firewall rules on stop.
#   Value: yes|no,  default: no
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets stopped
# (e.g. on system shutdown).
IPTABLES_SAVE_ON_STOP="no"

# Save current firewall rules on restart.
#   Value: yes|no,  default: no
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets
# restarted.
IPTABLES_SAVE_ON_RESTART="no"

# Save (and restore) rule and chain counter.
#   Value: yes|no,  default: no
# Save counters for rules and chains to /etc/sysconfig/iptables if
# 'service iptables save' is called or on stop or restart if SAVE_ON_STOP or
# SAVE_ON_RESTART is enabled.
IPTABLES_SAVE_COUNTER="no"

# Numeric status output
#   Value: yes|no,  default: yes
# Print IP addresses and port numbers in numeric format in the status output.
IPTABLES_STATUS_NUMERIC="yes"

# Verbose status output
#   Value: yes|no,  default: yes
# Print info about the number of packets and bytes plus the "input-" and
# "outputdevice" in the status output.
IPTABLES_STATUS_VERBOSE="no"

# Status output with numbered lines
#   Value: yes|no,  default: yes
# Print a counter/number for every rule in the status output.
IPTABLES_STATUS_LINENUMBERS="yes"
＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊


route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.10.0    *               255.255.255.0   U     0      0        0 eth0
169.254.0.0     *               255.255.0.0     U     0      0        0 eth0
default         192.168.10.1    0.0.0.0         UG    0      0        0 eth0

ssffzz1

奇怪了。

ssffzz1

iptables -t mangle -A PREROUTING -j TCPMSS -p tcp --tcp-flags SYN,ACK --set-mss 1400

先执行上述命令。
然后执行
tcpdump -s0 -i eth0 -w error.cap

然后开窗口上网，失败后。CTRL+C 中断tcpdump 再把error.cap压缩后发上来。

flb_2001

没道理的啊

pulic

原帖由 ssffzz1 于 2009-5-17 23:15 发表
iptables -t mangle -A PREROUTING -j TCPMSS -p tcp --tcp-flags SYN,ACK --set-mss 1400

先执行上述命令。
然后执行
tcpdump -s0 -i eth0 -w error.cap

然后开窗口上网，失败后。CTRL+C 中断tcpdump ...

这个iptables -t mangle -A PREROUTING -j TCPMSS -p tcp --tcp-flags SYN,ACK --set-mss 1400
命令有错误．
[root@localhost ~]# ping 202.103.24.68
PING 202.103.24.68 (202.103.24.6 56(84) bytes of data.
64 bytes from 202.103.24.68: icmp_seq=1 ttl=251 time=21.6 ms
64 bytes from 202.103.24.68: icmp_seq=2 ttl=251 time=168 ms

--- 202.103.24.68 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1000ms
rtt min/avg/max/mdev = 21.691/94.851/168.012/73.161 ms
[root@localhost ~]# iptables -t mangle -A PREROUTING -j TCPMSS -p tcp --tcp-flags SYN,ACK --set-mss 1400
iptables v1.3.5: --tcp-flags requires two args.

所以就我跳过这步．直接执行tcpdump.
error.cap 见附件．