[SOLVED]Firewall blocking LAN IP

[fuse]

Hi,
This morning one of the computers in the LAN got blocked by zentyal, if i list the firewall rules and grep for the ip or host of the blocked machine it is listed in the inospoof chain.
Does anyone have any idea how i can manually remove this machine for the chain?

Thanks

[jsalamero]

Can you post an example of the rules, the iptables output and a description of your network?

[fuse]

Hello,

Rules


Chain fnospoof (1 references)
target     prot opt source               destination         
fdrop      all  --  machine1.domain.tld     anywhere            MAC ! 00:xx:xx:xx:xx:xx
fdrop      all  --  192.168.1.80         anywhere            MAC ! 00:00:00:00:00:00
fdrop      all  --  192.168.1.0/24       anywhere           
fdrop      all  --  172.18.12.0/24       anywhere           
fdrop      all  --  192.168.133.0/24     anywhere           
             destination         

Chain inospoof (1 references)
target     prot opt source               destination         
idrop      all  --  machine1.domain.tld     anywhere            MAC ! 00:xx:xx:xx:xx:xx
idrop      all  --  192.168.1.80         anywhere            MAC ! 00:00:00:00:00:00
idrop      all  --  192.168.1.0/24       anywhere           
idrop      all  --  172.18.12.0/24       anywhere           
idrop      all  --  192.168.133.0/24     anywhere           

My network config is setup as followed,

192.168.1.0 (Internal Network eth0)
172.18.12.0 (Virtual Internet of eth0)

192.168.133.0 (eth1 WAN)

machine1.domain.tld  is the one being blocked by the rule, if i disable the firewall it can contact Zentyal successfully.

Thanks

[jsalamero]

I don't understand that virtual internet on a internal network. Please, paste iptables -L -n -v output.

[fuse]

Hello,
Attached.
Thanks

[jsalamero]

Do you have any object members with 00:00:00:00.00:00 as the MAC addr?

[c4rdinal]

This happened to me when we had a duplicate use of ip address on clients assigned with fixed ip in Network objects.

Check if you have this.

[fuse]

Do you have any object members with 00:00:00:00.00:00 as the MAC addr?

Nope.

[fuse]

This happened to me when we had a duplicate use of ip address on clients assigned with fixed ip in Network objects.

Check if you have this.

That was it.

Thanks