Ubuntu 14.04 getting ping: sendmsg: Operation not permitted

networkingUbuntu

The problem is out of my league apparently, Ubuntu cannot access any network but somehow my VMs using virtual box are all able to access the internet. I have attempted to do the following changes but as you can this was not successful. I am very confused as to what is wrong on my box. Any help appreciated.

carl@carl-Latitude-E6410:~$ sudo ip6tables -P INPUT ACCEPT
carl@carl-Latitude-E6410:~$ sudo ip6tables -P OUTPUT ACCEPT
carl@carl-Latitude-E6410:~$ sudo ip6tables -P FORWARD ACCEPT
carl@carl-Latitude-E6410:~$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
^C
--- 8.8.8.8 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1008ms
carl@carl-Latitude-E6410:~$ sudo iptables -P INPUT ACCEPT
carl@carl-Latitude-E6410:~$ sudo iptables -P OUTPUT ACCEPT
carl@carl-Latitude-E6410:~$ sudo iptables -P FORWARD ACCEPT
carl@carl-Latitude-E6410:~$ sudo service iptables restart
iptables: unrecognized service
carl@carl-Latitude-E6410:~$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
^C
--- 8.8.8.8 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1008ms

Best Answer

IPtables sometimes gets a little...wonky and there's many rules that don't get removed or get left befind.

Try iptables --flush to delete all your iptables rules.

Related Solutions

Ubuntu – nf_conntrack complaints in dmesg

I was a little curious about this one and found a pretty good explanation for your symptons. They are well described in nf_conntrack: table full - how the absence of rules can lead to unexpected behaviour.

TL;DR: Just running iptables -t nat -vnL starts loading the nf_conntrack module, resulting to get unintended stateful firewalling. I haven't verified this myself yet, you can bet I'll do it right tomorrow at work.

Solution: If you don't need NAT because you're doing bridging anyway, unload the nf_conntrack_* modules and all other dependant modules which depend on those. Disabling firewalling alltogether through chkconfig ip[6]tables off would be a good idea, too.

Disabling the firewall in Ubuntu can be done by sudo ufw disable and following these instructions if you don't want to reboot.

Linux – ping: sendmsg: Operation not permitted (sometimes)

I think problem is because of exceeded count of connections in conntrack - then new connections can't be established until old are expired.. Probably you can see in dmesg something like:

[1824447.285257] nf_conntrack: table full, dropping packet.
[1824447.522502] nf_conntrack: table full, dropping packet.

Current max of conntrack you can see in:

undefine@uml:~$ sudo sysctl net.nf_conntrack_max
net.nf_conntrack_max = 65536

and current conntrack count in:

undefine@uml:~$ sysctl net.netfilter.nf_conntrack_count
net.netfilter.nf_conntrack_count = 157

Currenct connections you can display using conntrack -L (tool from conntrack package). It's usefull to look there and check what type are them - it's possible that some aren't necessary.

You have three possibilites:

dont use conntrack (simply - don't use nat table and unload nf_conntrack module
disable conntrack for outgoint connections (in raw table use -j NOTRACK for problematic connections
increase connection count by:

undefine@uml:~$ sudo sysctl net.nf_conntrack_max=512000 net.nf_conntrack_max = 512000 or put net.nf_conntrack_max=512000 into /etc/sysctl.conf and then invoke sysctl -w to reload it.

Related Topic