Send the output from "iptables-save", please. Otherwise we could only guess if the problem is with your firewall rules or somewhere else.
Here we go! # Generated by iptables-save v1.3.5 on Mon Jan 15 19:09:43 2007 *mangle :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] :tcfor - [0:0] :tcout - [0:0] :tcpost - [0:0] :tcpre - [0:0] -A PREROUTING -j tcpre -A FORWARD -j tcfor -A OUTPUT -j tcout -A POSTROUTING -j tcpost COMMIT # Completed on Mon Jan 15 19:09:43 2007 # Generated by iptables-save v1.3.5 on Mon Jan 15 19:09:43 2007 *nat :PREROUTING ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :ppp0_masq - [0:0] -A POSTROUTING -o ppp0 -j ppp0_masq -A ppp0_masq -s 192.168.0.0/255.255.255.0 -m policy --dir out --pol none -j MASQUERADE COMMIT # Completed on Mon Jan 15 19:09:43 2007 # Generated by iptables-save v1.3.5 on Mon Jan 15 19:09:43 2007 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT DROP [0:0] :Drop - [0:0] :Reject - [0:0] :all2all - [0:0] :dropBcast - [0:0] :dropInvalid - [0:0] :dropNotSyn - [0:0] :dynamic - [0:0] :eth0_fwd - [0:0] :eth0_in - [0:0] :fw2all - [0:0] :fw2loc - [0:0] :fw2net - [0:0] :loc2all - [0:0] :loc2fw - [0:0] :loc2net - [0:0] :loc_frwd - [0:0] :logflags - [0:0] :net2all - [0:0] :net2fw - [0:0] :net2loc - [0:0] :net_frwd - [0:0] :norfc1918 - [0:0] :ppp0_fwd - [0:0] :ppp0_in - [0:0] :reject - [0:0] :rfc1918 - [0:0] :shorewall - [0:0] :smurfs - [0:0] :tcpflags - [0:0] -A INPUT -i lo -j ACCEPT -A INPUT -i ppp0 -j ppp0_in -A INPUT -i eth0 -j eth0_in -A INPUT -j Reject -A INPUT -j LOG --log-prefix "Shorewall:INPUT:REJECT:" --log-level 6 -A INPUT -j reject -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -A FORWARD -i ppp0 -j ppp0_fwd -A FORWARD -i eth0 -j eth0_fwd -A FORWARD -j Reject -A FORWARD -j LOG --log-prefix "Shorewall:FORWARD:REJECT:" --log-level 6 -A FORWARD -j reject -A OUTPUT -o lo -j ACCEPT -A OUTPUT -o ppp0 -m policy --dir out --pol ipsec -j fw2net -A OUTPUT -d 192.168.0.0/255.255.255.0 -o eth0 -m policy --dir out --pol ipsec -j fw2loc -A OUTPUT -d 255.255.255.255 -o eth0 -j fw2loc -A OUTPUT -d 224.0.0.0/240.0.0.0 -o eth0 -j fw2loc -A OUTPUT -j Reject -A OUTPUT -j LOG --log-prefix "Shorewall:OUTPUT:REJECT:" --log-level 6 -A OUTPUT -j reject -A Drop -p tcp -m tcp --dport 113 -j reject -A Drop -j dropBcast -A Drop -p icmp -m icmp --icmp-type 3/4 -j ACCEPT -A Drop -p icmp -m icmp --icmp-type 11 -j ACCEPT -A Drop -j dropInvalid -A Drop -p udp -m multiport --dports 135,445 -j DROP -A Drop -p udp -m udp --dport 137:139 -j DROP -A Drop -p udp -m udp --sport 137 --dport 1024:65535 -j DROP -A Drop -p tcp -m multiport --dports 135,139,445 -j DROP -A Drop -p udp -m udp --dport 1900 -j DROP -A Drop -p tcp -j dropNotSyn -A Drop -p udp -m udp --sport 53 -j DROP -A Reject -p tcp -m tcp --dport 113 -j reject -A Reject -j dropBcast -A Reject -p icmp -m icmp --icmp-type 3/4 -j ACCEPT -A Reject -p icmp -m icmp --icmp-type 11 -j ACCEPT -A Reject -j dropInvalid -A Reject -p udp -m multiport --dports 135,445 -j reject -A Reject -p udp -m udp --dport 137:139 -j reject -A Reject -p udp -m udp --sport 137 --dport 1024:65535 -j reject -A Reject -p tcp -m multiport --dports 135,139,445 -j reject -A Reject -p udp -m udp --dport 1900 -j DROP -A Reject -p tcp -j dropNotSyn -A Reject -p udp -m udp --sport 53 -j DROP -A all2all -m state --state RELATED,ESTABLISHED -j ACCEPT -A all2all -j Reject -A all2all -j LOG --log-prefix "Shorewall:all2all:REJECT:" --log-level 6 -A all2all -j reject -A dropBcast -m pkttype --pkt-type broadcast -j DROP -A dropBcast -m pkttype --pkt-type multicast -j DROP -A dropInvalid -m state --state INVALID -j DROP -A dropNotSyn -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP -A eth0_fwd -m state --state INVALID,NEW -j dynamic -A eth0_fwd -p tcp -m policy --dir in --pol none -j tcpflags -A eth0_fwd -s 192.168.0.0/255.255.255.0 -m policy --dir in --pol ipsec -j loc_frwd -A eth0_in -m state --state INVALID,NEW -j dynamic -A eth0_in -p tcp -m policy --dir in --pol none -j tcpflags -A eth0_in -s 192.168.0.0/255.255.255.0 -m policy --dir in --pol ipsec -j loc2fw -A fw2all -m state --state RELATED,ESTABLISHED -j ACCEPT -A fw2all -j Reject -A fw2all -j LOG --log-prefix "Shorewall:fw2all:REJECT:" --log-level 6 -A fw2all -j reject -A fw2loc -m state --state RELATED,ESTABLISHED -j ACCEPT -A fw2loc -p tcp -m tcp --dport 22 -j ACCEPT -A fw2loc -j Reject -A fw2loc -j LOG --log-prefix "Shorewall:fw2loc:REJECT:" --log-level 6 -A fw2loc -j reject -A fw2net -m state --state RELATED,ESTABLISHED -j ACCEPT -A fw2net -j ACCEPT -A loc2all -m state --state RELATED,ESTABLISHED -j ACCEPT -A loc2all -j Reject -A loc2all -j LOG --log-prefix "Shorewall:loc2all:REJECT:" --log-level 6 -A loc2all -j reject -A loc2fw -m state --state RELATED,ESTABLISHED -j ACCEPT -A loc2fw -p tcp -m tcp --dport 22 -j ACCEPT -A loc2fw -p udp -m udp --dport 123 -j ACCEPT -A loc2fw -j Reject -A loc2fw -j LOG --log-prefix "Shorewall:loc2fw:REJECT:" --log-level 6 -A loc2fw -j reject -A loc2net -m state --state RELATED,ESTABLISHED -j ACCEPT -A loc2net -j ACCEPT -A loc_frwd -o ppp0 -m policy --dir out --pol ipsec -j loc2net -A logflags -j LOG --log-prefix "Shorewall:logflags:DROP:" --log-level 6 --log-ip-options -A logflags -j DROP -A net2all -m state --state RELATED,ESTABLISHED -j ACCEPT -A net2all -j Drop -A net2all -j LOG --log-prefix "Shorewall:net2all:DROP:" --log-level 6 -A net2all -j DROP -A net2fw -m state --state RELATED,ESTABLISHED -j ACCEPT -A net2fw -p icmp -m icmp --icmp-type 8 -j reject -A net2fw -j Drop -A net2fw -j LOG --log-prefix "Shorewall:net2fw:DROP:" --log-level 6 -A net2fw -j DROP -A net2loc -m state --state RELATED,ESTABLISHED -j ACCEPT -A net2loc -j Drop -A net2loc -j LOG --log-prefix "Shorewall:net2loc:DROP:" --log-level 6 -A net2loc -j DROP -A net_frwd -d 192.168.0.0/255.255.255.0 -o eth0 -m policy --dir out --pol ipsec -j net2loc -A norfc1918 -s 172.16.0.0/255.240.0.0 -j rfc1918 -A norfc1918 -m conntrack --ctorigdst 172.16.0.0/12 -j rfc1918 -A norfc1918 -s 192.168.0.0/255.255.0.0 -j rfc1918 -A norfc1918 -m conntrack --ctorigdst 192.168.0.0/16 -j rfc1918 -A norfc1918 -s 10.0.0.0/255.0.0.0 -j rfc1918 -A norfc1918 -m conntrack --ctorigdst 10.0.0.0/8 -j rfc1918 -A ppp0_fwd -m state --state INVALID,NEW -j dynamic -A ppp0_fwd -m state --state NEW -m policy --dir in --pol none -j norfc1918 -A ppp0_fwd -p tcp -m policy --dir in --pol none -j tcpflags -A ppp0_fwd -m policy --dir in --pol ipsec -j net_frwd -A ppp0_in -m state --state INVALID,NEW -j dynamic -A ppp0_in -m state --state NEW -m policy --dir in --pol none -j norfc1918 -A ppp0_in -p tcp -m policy --dir in --pol none -j tcpflags -A ppp0_in -m policy --dir in --pol ipsec -j net2fw -A reject -m pkttype --pkt-type broadcast -j DROP -A reject -m pkttype --pkt-type multicast -j DROP -A reject -s 192.168.0.255 -j DROP -A reject -s 255.255.255.255 -j DROP -A reject -s 224.0.0.0/240.0.0.0 -j DROP -A reject -p tcp -j REJECT --reject-with tcp-reset -A reject -p udp -j REJECT --reject-with icmp-port-unreachable -A reject -p icmp -j REJECT --reject-with icmp-host-unreachable -A reject -j REJECT --reject-with icmp-host-prohibited -A rfc1918 -j LOG --log-prefix "Shorewall:rfc1918:DROP:" --log-level 6 -A rfc1918 -j DROP -A smurfs -s 192.168.0.255 -j LOG --log-prefix "Shorewall:smurfs:DROP:" --log-level 6 -A smurfs -s 192.168.0.255 -j DROP -A smurfs -s 255.255.255.255 -j LOG --log-prefix "Shorewall:smurfs:DROP:" --log-level 6 -A smurfs -s 255.255.255.255 -j DROP -A smurfs -s 224.0.0.0/240.0.0.0 -j LOG --log-prefix "Shorewall:smurfs:DROP:" --log-level 6 -A smurfs -s 224.0.0.0/240.0.0.0 -j DROP -A tcpflags -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j logflags -A tcpflags -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j logflags -A tcpflags -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j logflags -A tcpflags -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j logflags -A tcpflags -p tcp -m tcp --sport 0 --tcp-flags FIN,SYN,RST,ACK SYN -j logflags COMMIT # Completed on Mon Jan 15 19:09:43 2007 -- gentoo-user@gentoo.org mailing list
