Proxy arp problems

Nico Alberti
Mon, 07 Jun 2004 13:32:53 -0000

Hi everybody. I am trying to set up a Proxy ARPed dmz using Mandrake
MNF, but it seems I am missing something.

I have 3 networks:

eth0 	lan 	192.168.0.254 	255.255.255.0
eth1 	wan 	80.23.252.58 	255.255.255.248
eth2 	dmz 	192.168.10.1 	255.255.255.0

I set up a working lan masquerading with

#interface      subnet  address
eth1:0.0.0.0/0  192.168.0.0/24

and then I tried to use this configuration for Proxy Arp:

#address        interface       external        haveroute
80.23.252.59    eth2            eth1            No

The server in the DMZ has the same default gateway of the firewall.

But even if the rules from dmz to wan and vice versa are open, no
connection is possible from the two zones (while I can connect from the
''lan'' network to the server in the dmz). Moreover, if I try do
do a
connection from the server to a random ftp server I see a packet passing
trough the firewall
-----
Jun  7 15:18:31 gw kernel: Shorewall:dmz2all:ACCEPT:IN=eth2 OUT=eth1
SRC=80.23.2
52.59 DST=193.166.3.2 LEN=60 TOS=0x10 PREC=0x00 TTL=63 ID=50581 DF
PROTO=TCP SPT
=1037 DPT=21 WINDOW=5840 RES=0x00 SYN URGP=0
------
but there is no answer. I guess there is some routing problem from the
eth1 interface to eth2 or that the firewall did not answer correctly to
arp requests coming from the outside. In any case here is the firewall
routing table. Test connections to/from the firewall and the server in
the dmz were successful.

Destination     Gateway         Genmask         Flags Metric Ref    Use
Iface
80.23.252.59    0.0.0.0         255.255.255.255 UH    0      0        0 eth2
80.23.252.56    0.0.0.0         255.255.255.248 U     0      0        0 eth1
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.10.0    0.0.0.0         255.255.255.0   U     0      0        0 eth2
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
0.0.0.0         80.23.252.57    0.0.0.0         UG    0      0        0 eth1


I hope this can be a sufficiently shorewall generic answer even if I use
MNF. Thank you in advance for any advice.
--
Ciao
Nico