[Shorewall-users] Please help...

Tom Eastep
Mon, 15 Sep 2003 15:05:17 -0000

On Mon, 15 Sep 2003, Ricardo Kleemann wrote:

> Hi,
>
> I''m having a hard time figuring this out... I''m getting
this
> in my log:
>
> Sep 15 21:48:07 firewall Shorewall:all2all:REJECT: IN=eth1
> OUT= MAC=00:00:24:c0:01:09:00:00:cd:04:fd:48:08:00
> SRC=164.144.32.10 DST=38.118.152.30 LEN=52 TOS=00 PREC=0x00
> TTL=109 ID=54839 DF PROTO=TCP SPT=31202 DPT=80
> SEQ=2467470235 ACK=0 WINDOW=6144 SYN URGP=0
>
> However, I do have 38.118.152.30 setup to accept http
> requests. I have this in my rules file:
>
> ACCEPT  net     loc             tcp     80

What is the above rule supposed to do? It is probably superfluous.

> DNAT    net     loc:192.168.1.246       tcp     80      -
>    38.118.152.244
> DNAT    net     loc:192.168.1.252       tcp     80      -
>    38.118.152.29
> DNAT    net     loc:192.168.1.251       tcp     80      -
>    38.118.152.30
> DNAT    net     loc:192.168.1.250       tcp     80      -
>    38.118.152.31
>
> HTTP requests to 38.118.152.31, as well as to 38.118.152.244
> work fine. However, requests to the .30 IP get rejected, as
> is shown in the all2all:REJECT line above.
>
> What could be wrong?

a) Is eth1 your ''net'' interface?
b) Do you have any entries in /etc/shorewall/nat or
/etc/shorewall/proxyarp?