Today's #Linux #networking mystery:
A freelance work laptop started having trouble loading some, but not all websites. Other systems on same network had no such trouble. Further investigation showed that the affected laptop could reach any IPv6 address fine, but every IPv4 address was broken.
Although it could get a DHCP4 address from the local router, it couldn't send anything to the gateway, such as a ping. In fact, it could ping itself on IPv6 localhost, but not IPv4 (127.0.0.1). I also couldn't ping it from another system.
Is the network hardware broken? I booted from a live Linux USB and IPv4 connectivity was normal. So the problem is in the installed #Fedora somewhere.
I tried various diagnostic commands around ip addr, link, route, ifconfig; compared results to a working system, all looked fine. Poking around NetworkManager or DNS or etc/hosts, no good, all normal.
Is the tcp/ip stack corrupted? It's built into the Linux kernel, so I took the opportunity to upgrade to the next Fedora release. Didn't fix the problem.
It can't be a firewall. Ufw has never been on this laptop. Firewalld can be stopped and doing that doesn't fix it. IPtables is very arcane and I don't know how to read it, but it also looks ok? Some extra endpoint protection rules in there from #BitDefender, but that should be fine.
Mystifying! After a little more headscratching, I take a closer look at the IPtables. It seems to forward everything to a chain that "returns" various normal protocols and "drops" everything else. IP6tables has no such rule, and IPv6 traffic works okay. It feels suspicious.
Work IT said BitDefender is mandatory, but they don't actually enforce that. So I uninstall BitDefender, and... all IPv4 starts working immediately.
That thing updated itself automatically and set up new rules that drop all IPv4 packets!? Yeesh. Anyway, lesson of the day: there's always an explanation somewhere. Also, learn to interpret #IPtables better.