MASQ nightmare - 99% solved

Guilsson .
Fri, 29 Feb 2008 14:32:04 -0000

I have a 2 firewalls with 8 interfaces each in HA. Two interfaces of
then are CORPorate and DMZ.

Since I have some devices in DMZ with different default gateway (some
points to FW1 and others to FW2), I needed to create a quite complex
setup of inclusions/exclusions and source/destination to allow video
conferencing devices go to directly to the GateKeeper in DMZ, without
NAT.

Sometimes VC registered in GK with the FW''s IP, sometimes registered
with VC''s IP (corporate IP, the correct).
I''ve spent several hours troubleshooting this situation.

Restarting Shorewall and un/re-registering the VC the situation
changed randomly.
There is a mix of several VC devices (around 30). Different models,
brands, even some PCs with Netmeeting.
Even cleaning all entries in MASQ to/from CORP amd DMZ, strange things happened.
I got almost crazy.

I just had migrated this FW firewall from Fedora Core 3 (Shorewall
2.x) to Fedora 8 (Shorewall 4.x).
Before, the same rules were applied and everything worked fine

When I noticed that WITHOUT any masqs some devices still registered
with NATed IP, I went further and discovered:
- 2 Netfilter modules are loaded by default in Fedora 8
--- nf_nat_h323
--- nf_conntrack_h323

Unloading (modprobe -r) then, just like a Magic, everything back to
normal operations. My masq entries worked as should be.

Two doubts:
1) Every shorewall restart load these two modules again. How can I
configure Shorewall to not load them ?
2) Why, even without masq entries, some devices got NATed (modules problem?) ?

-Guilsson