SuSEfirewall2 FW_SERVICES_ACCEPT_RELATED question

Hi o/,

I’m testing SuSEfirewall2 and i’m just wondering here, why might when i go to speedtest.net my connection drops after a 1 second.
Im learning here, and ill provide any info that might be needed if anyone is interested.

I hopefully might be missing something quite obvious.

Network setup (simple)
eth0-ext 172.16.1.2 (gateway 172.16.1.1)
eth1-int 172.16.0.1
client 172.16.0.2

masq=on
FW_ROUTE=“yes”
FW_MASQ_NETS=“172.16.1.0/24 172.16.0.0/24”
FW_FORWARD=“172.16.0.0/24,172.16.1.0/24 172.16.1.0/24,172.16.0.0/24”
FW_FORWARD_MASQ=“0/0,172.16.0.1,tcp,1”
FW_LOAD_MODULES=“nf_conntrack_netbios_ns”

Everything else is as default… i think :slight_smile:

Im watching the ping here on 8.8.8.8 and its droping just for a sec every 2mins or so as well.

I’m within a 172.16.1.x network with firewall off on the modem as i’m testing this.

NAME=“openSUSE Leap”
VERSION=“42.1”
64bit Sunfire Test server.

Thanks in advance for any help peeps might have :slight_smile:

Standard “best practices” for benchmarking includes…

  • Tests that don’t run with direct access to hardware should be suspect. That means that tests that generally run in OS, and even more so in applications like web browsers are questionable.
  • Initial tests should always be considered unreliable and the results discarded.
  • Always run a series of tests and calculate a mean, perhaps throwing out anything that’s clearly anomalous.
  • Tests that generate unreliable numbers might be worthless for the actual numbers they generate but can often be used relative to the same test run elsewhere. The principle is that if the same issues are standard in your testing, that means the <relative> differences might be useful even if the <absolute> numbers might be worthless. So, for example maybe you use a bandwidth test in a web browser which would mean that it shouldn’t be reliable comparing to your ISP’s stated limits. But, if you use the same test on another machine in your network or a machine in another network, then the <relative> differences of the results from each machine might suggest whether there is a machine-specific or a network connection-specific issue.

HTH,
TSU

Thanks for the reply Tus, a good reminder for everyone :slight_smile:
Here, I’m wondering if you might help me with my routing, I’v disabled the firewall, and just want to route between 2 networks 172.16.1.0 and 192.16.0.0
ISProuter 172.16.1.1
Susemachine
eth0=172.16.1.100 255.255.255.0
eth1=192.168.0.1 255.255.255.0)
Default Gateway Yast= 172.16.1.1 Ipv4 forwarding = on.
PC (192.168.0.2 mask 255.255.255.0 GW 192.168.0.1)
From PC i can ping 192.168.0.1 and 172.16.1.100 but not 172.16.1.123 (working machine) and not 8.8.8.8. (of course)
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 172.16.1.1 0.0.0.0 UG 0 0 0 eth2
172.16.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth3

Iv tried a lot of routes but I’m lost, I can’t believe I can’t grasp this simple stuff :confused:
Trying to get routes first before I put a firewall between 172 and 192.

Although might be related in a larger solution, this appears to be a completely different question so should be the subject of a new, different thread.

But,
From what you describe, it sounds like you’ve created a network 192.168.0.0/24 behind your network 172.16.1.0/24,
And then
From a machine (PC) with IP address 192.168.0.2, you’re trying to ping a machine in the 172.16.1.0/24 network with IP address 172.16.1.123/24. I am assuming this machine called “working machine” is properly and physically connected within the 172.16.1.0/24 network(If not, that’s your problem).

From what you describe, that should work.
But, the reverse of what you describe which would be to try to ping the PC machine from the “working machine” should not work, you will need to create a routing table entry to the 192.168.0.0/24 network in the routing table of the “working machine.”

Also, if your “ISProuter” is an Internet Gateway, you should also be able to ping 8.8.8.8.

If your networks are configured differently than what I describe, that would have its own problems, for instance if your 192.168.0.0/24 network isn’t behind the 172.16.1.0/24 network, maybe configured side by side in some odd way.

These kinds of problems are usually easily resolved if you organize and post the <full> network configurations for each machine, and maybe in a graphical diagram. That way you can see every setting of each machine and can identify what might be missing.

TSU