Iptables – Ping: sendmsg: operation not permitted error after installing iptables on Arch GNU/Linux

arch-linuxiptablesnat;networking

Yesterday I got a new computer as my homeserver, a HP Proliant Microserver.
Installed Arch Linux on it, with kernel version 3.2.12.

After installing iptables (1.4.12.2 – the current version AFAIK) and changing the net.ipv4.ip_forward key to 1, and enabling forwarding in the iptables configuration file (and rebooting), the system cannot use any of its network interfaces. Ping fails with

Ping: sendmsg: operation not permitted

If I remove iptables completely, networking is okay, but I need to share the Internet connection to the local network.

eth0 – wan NIC integrated on the motherboard (Broadcom NetXtreme BCM5723).

eth1 – lan NIC in a pci-express slot (Intel 82574L Gigabit Network)

Since it works without iptables(server can access the internet, and I can login with ssh from the internal network), I assume it has something to do with iptables. I do not have much experience with iptables, so I used these as reference (separate from each other of course…):

wiki.archlinux.org/index.php/Simple_stateful_firewall#Setting_up_a_NAT_gateway

revsys.com/writings/quicktips/nat.html

howtoforge.com/nat_iptables

On my previous server, I used the revsys guide to set up nat, worked like a charm.

Anyone experienced anything like this before? What am I doing wrong?

Best Answer

The error message:

Ping: sendmsg: operation not permitted

means that your server is not allowed to send ICMP packets. You need to allow your server to send traffic via one or more of the configured interfaces. You can do this by:

Set OUTPUT chain policy to ACCEPT to allow all outgoing traffic from your box:
```
sudo iptables -P OUTPUT ACCEPT
```
Set OUTPUT chain policy to DROP and then allow selectively the type of traffic you need.

This applies to all chains not only the OUTPUT chain. INPUT chain controls the traffic received by your box. FORWARD chain deals with traffic forwarded through the box.

Related Solutions

Ubuntu 14.04 getting ping: sendmsg: Operation not permitted

IPtables sometimes gets a little...wonky and there's many rules that don't get removed or get left befind.

Try iptables --flush to delete all your iptables rules.

Linux – ping: sendmsg: Operation not permitted (sometimes)

I think problem is because of exceeded count of connections in conntrack - then new connections can't be established until old are expired.. Probably you can see in dmesg something like:

[1824447.285257] nf_conntrack: table full, dropping packet.
[1824447.522502] nf_conntrack: table full, dropping packet.

Current max of conntrack you can see in:

undefine@uml:~$ sudo sysctl net.nf_conntrack_max
net.nf_conntrack_max = 65536

and current conntrack count in:

undefine@uml:~$ sysctl net.netfilter.nf_conntrack_count
net.netfilter.nf_conntrack_count = 157

Currenct connections you can display using conntrack -L (tool from conntrack package). It's usefull to look there and check what type are them - it's possible that some aren't necessary.

You have three possibilites:

dont use conntrack (simply - don't use nat table and unload nf_conntrack module
disable conntrack for outgoint connections (in raw table use -j NOTRACK for problematic connections
increase connection count by:

undefine@uml:~$ sudo sysctl net.nf_conntrack_max=512000 net.nf_conntrack_max = 512000 or put net.nf_conntrack_max=512000 into /etc/sysctl.conf and then invoke sysctl -w to reload it.

Best Answer

Related Solutions

Ubuntu 14.04 getting ping: sendmsg: Operation not permitted

Linux – ping: sendmsg: Operation not permitted (sometimes)

Related Topic