thr3ads.net - Shorewall users - Single IP, multiple servers, servers in DMZ not behaving properly [Dec 2006]

If this information is useful, please help other people find it:
Share via:

Garby Trash

2006-Dec-04 07:21 UTC

Single IP, multiple servers, servers in DMZ not behaving properly

Dear Friends:

I am very new to shorewall stuff. I am trying to create (obviously for
the first time) a home datacenter with a setup like below:




                      +--------+
                      | ADSL   |
                      | Modem  |
                      +---+----+
                          |
                   eth0: 81.216.202.218
                   +------+--------+
                   | OpenVZ box w  |____DMZ connected
                   | HN as firewall|      |with xover
                   +-and VPSes   --+      |cable
      LOC                 |         eth2: 192.168.1.254
      eth1: 192.168.0.254 |         +-----+---+
      +------..............         |         |
      |local router+gw              192.168.1.250
      +--+---+                      +---------+
      192.168.2.254
         |
     |___|_______+
     |           |
     |           |
     |           |
  +-----+    +---+---+
  |     |    |       |
  +-----+    +-------+
  192.168.2.0/24


I want to make the 192.168.1.250 (a trixbox voip server) as well as
other webservers in the firewall+router cum OpenVZ box with several
virtual servers in the DMZ zone accessible to the world and vice
versa.

I did everything I could in the rules and policy. When I port
forwarded dmz:192.168.1.250 in rules, the rest in DMZ including $FW
itself became unavailable. On the other hand the voip server could
connect to the remote voip terminator, but could not pass through the
audio. I tried to separately port forward the necessary ports (namely
udp 5060-5088 for sip, udp 8000-20000 for rtp and 4569 for iax and tcp
25 and 110 for smtp and pop respectively. But none worked.

I shall be obliged if any of the shorewall gurus could help me how to
host several servers (voip and webserver with VPSes inside).

Kindly guide me. Please let me inform you that it is Centos4.4 based
machines with Shorewall 3.0.7 and the output of some of the commands
are below:

# ip addr show
2: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:50:8b:90:16:21 brd ff:ff:ff:ff:ff:ff
    inet 81.216.202.218/27 brd 81.216.202.223 scope global eth0
6: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:e0:4c:39:25:2c brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.254/24 brd 192.168.0.255 scope global eth1
8: eth2: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:01:02:f0:c1:52 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.254/24 brd 192.168.1.255 scope global eth2
1: venet0: <BROADCAST,POINTOPOINT,NOARP,UP> mtu 1500 qdisc noqueue
    link/void



# ip route show
81.216.202.192/27 dev eth0  proto kernel  scope link  src 81.216.202.218
192.168.1.0/24 dev eth2  proto kernel  scope link  src 192.168.1.254
192.168.0.0/24 dev eth1  proto kernel  scope link  src 192.168.0.254
169.254.0.0/16 dev eth2  scope link
default via 81.216.202.193 dev eth0


Kindly let me know if I need to furnish any more information to get my
home network running. Thank you.

With best regards,
GT

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net''s Techsay panel and you''ll get the chance
to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

Tom Eastep

2006-Dec-04 15:38 UTC

head link

Re: Single IP, multiple servers, servers in DMZ not behaving properly

Garby Trash wrote:> Dear Friends:
> 
> I am very new to shorewall stuff. I am trying to create (obviously for
> the first time) a home datacenter with a setup like below:
> 
> 
> 
> 
>                       +--------+
>                       | ADSL   |
>                       | Modem  |
>                       +---+----+
>                           |
>                    eth0: 81.216.202.218
>                    +------+--------+
>                    | OpenVZ box w  |____DMZ connected
>                    | HN as firewall|      |with xover
>                    +-and VPSes   --+      |cable
>       LOC                 |         eth2: 192.168.1.254
>       eth1: 192.168.0.254 |         +-----+---+
>       +------..............         |         |
>       |local router+gw              192.168.1.250
>       +--+---+                      +---------+
>       192.168.2.254
>          |
>      |___|_______+
>      |           |
>      |           |
>      |           |
>   +-----+    +---+---+
>   |     |    |       |
>   +-----+    +-------+
>   192.168.2.0/24
> 
> 
> I want to make the 192.168.1.250 (a trixbox voip server) as well as
> other webservers in the firewall+router cum OpenVZ box with several
> virtual servers in the DMZ zone accessible to the world and vice
> versa.
Given that you have only one IP address, the webserver solution has nothing to
do with Shorewall. You need to run an HTTP proxy on the Shorewall box that can
route requests based on host name. Apache can offer this type of service and I
believe that Squid can also.
> 
> I did everything I could in the rules and policy. When I port
> forwarded dmz:192.168.1.250 in rules, the rest in DMZ including $FW
> itself became unavailable.
That''s expected. Each connection to a particular (protocol,port) pair
can either
be sent to exactly one place or it can be spread among several destinations in
round-robin or random fashion (Shorewall only supports round-robin). Using an
IP-only solution like Netfilter/Shorewall, those are your only choices. So if
you forward connections for (tcp,80) to 192.168.1.250, all HTTP connections will
go there.
> On the other hand the voip server could
> connect to the remote voip terminator, but could not pass through the
> audio. I tried to separately port forward the necessary ports (namely
> udp 5060-5088 for sip, udp 8000-20000 for rtp and 4569 for iax and tcp
> 25 and 110 for smtp and pop respectively. But none worked.
"It didn''t work" isn''t a problem report. We need to
see the information asked
for in http://www.shorewall.net/support.htm#Guidelines. But before you send
that, you may want to spend a little time with
http://www.shorewall.net/troubleshoot.htm.

Also for the VOIP issue, I suggest that you look in the mailing list archives --
I believe that Paul Gear posted definitive instructions a while back.
> 
> I shall be obliged if any of the shorewall gurus could help me how to
> host several servers (voip and webserver with VPSes inside).
Again -- using an IP-only solution, all of your webservers would need to have
the same content since you can''t determine in advance which server is
going to
handle a given connection (unless you use non-standard port numbers to access
some of your servers). You might also take a look at the port-forwarding
troubleshooting tips in Shorewall FAQs 1a and 1b.

I very much suspect that you are the first Shorewall user to even attempt to use
OpenVZ. Seems like virtualization products are multiplying like rabbits these
days. Anyone else used this with Shorewall? I notice that the installation
instructions specifically instruct the user to disable the RedHat/Fedora
firewall on the HN.

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key



-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net''s Techsay panel and you''ll get the chance
to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

Tom Eastep

2006-Dec-04 19:24 UTC

head link

Re: Single IP, multiple servers, servers in DMZ not behaving properly

Tom Eastep wrote:> Garby Trash wrote:
> 
>> On the other hand the voip server could
>> connect to the remote voip terminator, but could not pass through the
>> audio. I tried to separately port forward the necessary ports (namely
>> udp 5060-5088 for sip, udp 8000-20000 for rtp and 4569 for iax and tcp
>> 25 and 110 for smtp and pop respectively. But none worked.
> 
> "It didn''t work" isn''t a problem report. We
need to see the information asked
> for in http://www.shorewall.net/support.htm#Guidelines. But before you send
> that, you may want to spend a little time with
> http://www.shorewall.net/troubleshoot.htm.
> 
> Also for the VOIP issue, I suggest that you look in the mailing list
archives --
> I believe that Paul Gear posted definitive instructions a while back.
Paul''s post covered SIP only and was posted on 7/17/2006 (the current
SF mailing
list archives issues won''t prevent you from finding it).

If Shorewall is blocking any requests, then they should be showing up in your
log.

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key



-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net''s Techsay panel and you''ll get the chance
to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

Shorewall users - Dec 2006 - Single IP, multiple servers, servers in DMZ not behaving properly

Single IP, multiple servers, servers in DMZ not behaving properly

Re: Single IP, multiple servers, servers in DMZ not behaving properly

Re: Single IP, multiple servers, servers in DMZ not behaving properly