Re: Shorewall 4.06 + DNAT + Problem with internalrouting

Gianni Socionovo
2008-08-05T11:34:03Z

OpenGroupware.org

Re: [Shorewall-users] Shorewall 4.06 + DNAT + Problem with internalrouting

    mailLabel&amp;nbsp

        sender:

        Gianni Socionovo

      &lt;#AttributeCell&gt;
        &lt;#Font&gt;&lt;#DateLabel/&gt;:#Font&gt;
      #AttributeCell&gt;
      &lt;#ValueCell&gt;
        &lt;#Font&gt;&lt;#Date/&gt; #Font&gt;
      #ValueCell&gt;

        content:

Shorewall Users  wrote:
&gt; Tom Eastep wrote:
&gt; &gt; Gianni Socionovo wrote:
&gt; &gt;
&gt; &gt;&gt;
&gt; &gt;&gt; from the log i got:
&gt; &gt;&gt;
&gt; &gt;&gt; Aug  4 19:10:07 mylinuxbox kernel: [276232.278815]
&gt; &gt;&gt; Shorewall:net_dnat:DNAT:IN=eth0 SRC=88.xx.xx.xx
DST=88.xx.xx.1 LEN=48
&gt; &gt;&gt; TOS=0x00 PREC=0x00 TTL=128 ID=4891 DF PROTO=TCP
SPT=1128 DPT=22
&gt; &gt;&gt; WINDOW=16384 RES=0x00 SYN URGP=0 Aug  4 19:10:07
mylinuxbox kernel:
&gt; &gt;&gt; [276232.278839] Shorewall:FORWARD:REJECT:IN=eth0
OUT=eth0
&gt; &gt;&gt; SRC=88.xx.xx.xx DST=10.10.2.4 LEN=48 TOS=0x00
PREC=0x00 TTL=127
&gt; &gt;&gt; ID=4891 DF PROTO=TCP SPT=1128 DPT=80 WIN
 DOW=16384 RES=0x00 SYN URGP=0
&gt; &gt;&gt; It seem that DNAT rule work well but after DNAT REJECT
policy takes
&gt; &gt;&gt; place.
&gt; &gt;&gt;
&gt; &gt;&gt; Can anyo
 ne help me to solve the configuration error? I need urgently
&gt; &gt;&gt; to set other DNAT rules towards the other nested
zones.
&gt; &gt;
&gt; &gt; It''s a routing issue. See
http://www.shorewall.net/Multiple_Zones.html
&gt; &gt;
&gt;
&gt; Note that since you didn''t follow the problem reporting
Guidelines
&gt; (http://www.shorewall.net/support.htm#Guidelines), we can''t
tell you how your
routing is wrong. But from the REJECT message, it is apparent that your
&gt; router is routing 10.10.2.4 out of eth0, not eth1 as you intend.
&gt;
&gt; -Tom
&gt; --
&gt; Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
&gt; Shoreline,     \ http://shorewall.net
&gt; Washington USA  \ teastep@shorewall.n
 et
&gt; PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key
&gt;
&gt;

Hello Tom, obviously I obfuscated for the public mailing list the real IP
nu
 mbers of Shorewall configuration.
Tell me if i can send you all information and trace fiel to protected email
recipient
--
Ing. Gianni Socionovo
MEP SpA

              footerRowLabel1
              5
             ©
            footerRowLabel2