[Shorewall-users] Static routes question.

Tom Eastep
2002-09-24T17:09:51Z

João Alexandre - Pluridata/LI wrote:
> Dear All,
>
> This is my first post and I''m kind a new to this mailing list. I
searched
> the archives and didn''t find a suitable solution for my problem or
at least
> I didn''t search for the right keywords. So here it goes:
>
> I have a box running shorewall (on MDK 8.2) with 3 nics (lan=eth0, dmz=eth1
> and wan=eth2). My wan connection is a cable modem/DHCP and all is running
> quiet well. This box is the default gateway for all the clients behind this
> shorewall box. The lan is something like 192.168.11.0/24 where
> 192.168.11.252 is the shorewall box, the problem arrives when in this same
> network (lan) I have a router (ISDN dial-up) that I use to connect remotely
> to a client and do administrative stuff. This remote network is like
> 192.168.101.0/24 and so I created a "static-routes" file in
> "/etc/sysconfig/" with "eth0 net 192.168.101.0 netmask
255.255.255.0 gw
> 192.168.11.254" (192.168.11.254 is the ip of the dial-up router.
>
> I tried to create rules, several configurations and so on with no success
> (always shorewall complaining with the traffic like: Sep 24 17:20:30
> 192.168.10.252 kern.info kernel: Shorewall:wan2all:REJECT:IN=eth0 OUT=eth0
> SRC=192.168.11.65 DST=192.168.101.11 LEN=60 TOS=0x00 PREC=0x00 TTL=127
> ID=3833 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=512). So what I did was to add
a
> permanent static route in my clients and this was my workaround. This
remote
> network (192.168.101.0/24) doesn''t need/shouldn''t use the
shorewall box for
> any purpose.
>

That is actually the best way to do this since as you say, this traffic
shouldn''t use the Shorewall box.

> How is the correct way to implement a static route in the shorewall box,
> just like you add a static route in a common router?

Setting up the route itself shouldn''t be done in Shorewall but should
be
done using your distribution''s perferred method
(''static-routes'' file in
your case).

> Probably some of you
> may had the same problem or similar or even in the case of several routers
> and can tip me.
>

It looks like you have defined the 192.168.101.0/24 network as zone
''wan''?
If so, you probably want policies such as:

wan	lan	ACCEPT
lan	wan	ACCEPT

In addition, if you aren''t running Shorewall 1.3.8 then you need to
specify the ''multi'' option for eth0 in
/etc/shorewall/interfaces.

-Tom
--
Tom Eastep    \ Shorewall - iptables made easy
AIM: tmeastep  \ http://www.shorewall.net
ICQ: #60745924  \ teastep@shorewall.net