Shorewall users - Dec 2010 - failure of FTP connection

My network is described,
http://carnot.yi.org/NetworksPage.html
with a diagram,
http://carnot.yi.org/NetworkExtant.jpg
.  Linux router, Joule, has Debian Squeeze.

The interfaces in the diagram are abbreviated.
eth0 = MainBoard ... to the Internet
eth1 = LocPCI1 ... to Curie
eth2 = LocACS29H901847 ... to Heaviside

Until a few weeks back, FTP from Heaviside to Curie was reliable.
Now the connection fails with this line to /var/log/syslog.
Dec 26 18:32:48 joule kernel: [10586.307679]
Shorewall:FORWARD:REJECT:IN=LocACS29H901847 OUT=LocPCI1 SRC=172.23.5.2
DST=172.23.4.2 LEN=44 TOS=0x00 PREC=0x00 TTL=31 ID=5498 PROTO=TCP SPT=1120
DPT=21 WINDOW=8192 RES=0x00 SYN URGP=0
To my understanding, Shorewall blocks the connection.

FTP from Heaviside to Joule still works.
I''ve read http://www.shorewall.net/FTP.html .
The failure happens within loc; address translation shouldn''t be
involved.

The output of shorewall show is here.
http://carnot.yi.org/ShorewallShow

The ftp modules seem OK.
peter@joule:~$ lsmod | grep ftp
nf_nat_tftp              702  0 
nf_nat_ftp              1519  0 
nf_conntrack_tftp       2321  1 nf_nat_tftp
nf_conntrack_ftp        4272  1 nf_nat_ftp
nf_nat                 10568  12
ipt_REDIRECT,ipt_NETMAP,ipt_MASQUERADE,nf_nat_tftp,nf_nat_sip,nf_nat_pptp,nf_nat_proto_gre,nf_nat_irc,nf_nat_h323,nf_nat_ftp,nf_nat_amanda,iptable_nat
nf_conntrack           38075  31
xt_connlimit,ipt_MASQUERADE,ipt_CLUSTERIP,nf_nat_tftp,nf_nat_snmp_basic,nf_nat_sip,nf_nat_pptp,nf_nat_irc,nf_nat_h323,nf_nat_ftp,nf_nat_amanda,nf_conntrack_amanda,nf_conntrack_sane,nf_conntrack_tftp,nf_conntrack_sip,nf_conntrack_proto_sctp,nf_conntrack_pptp,nf_conntrack_proto_gre,nf_conntrack_netlink,nf_conntrack_netbios_ns,nf_conntrack_irc,nf_conntrack_h323,nf_conntrack_ftp,xt_helper,xt_conntrack,xt_CONNMARK,xt_connmark,xt_state,iptable_nat,nf_nat,nf_conntrack_ipv4

Subtle suggestions and blatant observations welcome.
Thanks,                    ... Peter E.


-- 
Telephone 1 360 450 2132.
Shop pages http://carnot.yi.org/ accessible as long as the old drives survive.
Personal pages http://members.shaw.ca/peasthope/ .


------------------------------------------------------------------------------
Learn how Oracle Real Application Clusters (RAC) One Node allows customers
to consolidate database storage, standardize their database environment, and, 
should the need arise, upgrade to a full multi-node Oracle RAC database 
without downtime or disruption
http://p.sf.net/sfu/oracle-sfdevnl

On 12/26/10 6:10 PM, peasthope@shaw.ca wrote:
> Subtle suggestions and blatant observations welcome.
See Shorewall FAQ 17 for information about understanding the log
message. Bottom line is that the SOURCE (interface, IP address) and/or
the DEST (interface,IP address) are not in any of the defined zones (see
the output of ''shorewall show zones'').

And as always, network diagrams and hand waving do not constitute a
useful problem report (the output of ''shorewall show'' is a
weak
substitute for the output of ''shorewall dump'').

See http://www.shorewall.net/support.htm#Guidelines

-Tom
-- 
Tom Eastep        \ When I die, I want to go like my Grandfather who
Shoreline,         \ died peacefully in his sleep. Not screaming like
Washington, USA     \ all of the passengers in his car
http://shorewall.net \________________________________________________



------------------------------------------------------------------------------
Learn how Oracle Real Application Clusters (RAC) One Node allows customers
to consolidate database storage, standardize their database environment, and, 
should the need arise, upgrade to a full multi-node Oracle RAC database 
without downtime or disruption
http://p.sf.net/sfu/oracle-sfdevnl