thr3ads.net - Shorewall users - Problems with reaching ppp+ interfaces [Mar 2012]

If this information is useful, please help other people find it:
Share via:

Bart Smink

2012-Mar-22 21:31 UTC

Problems with reaching ppp+ interfaces

Hi everyone,

I am having some trouble with configuring the rules file for ppp+
interfaces. The situation is as follows:

loc -> l2tp:172.28.1.0/24 works
loc -> l2tp:172.28.5.0/24 ping fails with no route to host

l2tp:172.28.1.0/24 -> loc works
l2tp:172.28.5.0/24 -> loc fails with no route to host
l2tp:172.28.1.0/24 <-> l2tp:172.28.5.0/24 works


But I cannot find a configuration file where this restriction could come
from. I was thinking it had to be the routing table, but it shows no
difference with the other connection ppp0 that does work.

Routing table is as follows:
Destination     Gateway         Genmask         Flags Metric Ref    Use
Iface
172.28.5.2      *                     255.255.255.255 UH    0      0
0 ppp1
172.28.1.10     *                    255.255.255.255 UH    0      0
0 ppp0
172.28.5.0      *                     255.255.255.0   U     0      0
0    ppp1
172.28.0.0      *                     255.255.0.0     U     0      0
0      eth1
129.125.0.0     *                     255.255.0.0     U     0      0
  0    eth0
default         129.125.101.251 0.0.0.0         UG    0      0
0    eth0

The ifconfig output:
eth0      Link encap:Ethernet  HWaddr 00:04:75:E5:5B:18
          inet addr:129.125.102.34  Bcast:129.125.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:49113298 errors:0 dropped:0 overruns:436 frame:0
          TX packets:80804347 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:729848396 (696.0 MiB)  TX bytes:981895257 (936.4 MiB)
          Interrupt:201 Base address:0xe000

eth1      Link encap:Ethernet  HWaddr 00:0C:6E:3E:22:A9
          inet addr:172.28.1.1  Bcast:172.28.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:80883923 errors:0 dropped:0 overruns:0 frame:0
          TX packets:44472324 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:988163486 (942.3 MiB)  TX bytes:30205189 (28.8 MiB)
          Interrupt:201 Base address:0x9800

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:4453 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4453 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:925463 (903.7 KiB)  TX bytes:925463 (903.7 KiB)

ppp0      Link encap:Point-to-Point Protocol
          inet addr:172.28.1.1  P-t-P:172.28.1.10  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1400  Metric:1
          RX packets:6 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3
          RX bytes:138 (138.0 b)  TX bytes:318 (318.0 b)

ppp1      Link encap:Point-to-Point Protocol
          inet addr:172.28.1.1  P-t-P:172.28.5.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:1115 errors:0 dropped:0 overruns:0 frame:0
          TX packets:724 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3
          RX bytes:89559 (87.4 KiB)  TX bytes:113560 (110.8 KiB)


Here is the rules file:
#l2tp
ACCEPT       l2tp:172.28.0.0/16  fw

ACCEPT       l2tp:172.28.1.0/24 l2tp:172.28.0.0/16
ACCEPT       l2tp:172.28.1.0/24 loc
ACCEPT       l2tp:172.28.1.0/24 net

ACCEPT       l2tp:172.28.2.0/24 l2tp:172.28.2.0/24

ACCEPT       l2tp:172.28.3.0/24 l2tp:172.28.3.0/24

ACCEPT       l2tp:172.28.4.0/24 l2tp:172.28.4.0/24

#ACCEPT       l2tp:172.28.5.0/24 l2tp:172.28.5.0/24
ACCEPT       l2tp:172.28.5.0/24 loc
ACCEPT       l2tp:172.28.5.0/24 l2tp:172.28.0.0/16

#internet Access
#ACCEPT       l2tp:172.28.4.0/24 net
ACCEPT        l2tp:172.28.5.0/24 net

#SMB
ACCEPT       l2tp:172.28.3.0/24 loc:172.28.1.101/32 tcp  445 -
ACCEPT       l2tp:172.28.4.0/24 loc:172.28.1.101/32 tcp  445 -

#RDP
ACCEPT       l2tp:172.28.3.0/24 loc:172.28.1.107/32 tcp 3389 -
ACCEPT       l2tp:172.28.4.0/24 loc:172.28.1.107/32 tcp 3389 -

and the policy file:
#SOURCE DEST    POLICY          LOG     LIMIT:          CONNLIMIT:
#                               LEVEL   BURST           MASK
fw      all     ACCEPT
loc     all     ACCEPT
vpn     all     ACCEPT
l2tp    vpn     ACCEPT
l2tp    fw      ACCEPT
l2tp    all     REJECT        7
net     all     DROP
all     all     REJECT

The message in /var/log/messages that the reject rule is outputting is:

Mar 22 21:50:44 gateway kernel: Shorewall:sfilter1:DROP:IN=eth1 OUT=eth1
SRC=172.28.1.102 DST=172.28.1.10 LEN=48 TOS=0x00 PREC=0x00 TTL=63 ID=58702
DF PROTO=TCP SPT=53627 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0

But a ping command from 172.28.1.102 to 172.28.1.10 does work.

Zones file is:
fw      firewall
net     ipv4
loc     ipv4
vpn     ipsec
l2tp    ipv4

Interfaces;
#ZONE   INTERFACE       BROADCAST       OPTIONS
net     eth0            detect
loc     eth1            detect
l2tp    ppp+            -               routeback


I believe these are the most relevant items of a Shorewall dump. Also with
these settings I cannot find anything wrong, except the output situation. I
would really appreciate anyone''s help on this.

Greetings,

Bart


------------------------------------------------------------------------------
This SF email is sponsosred by:
Try Windows Azure free for 90 days Click Here 
http://p.sf.net/sfu/sfd2d-msazure

Eric Teeter

2012-Mar-22 21:49 UTC

head link

Re: Problems with reaching ppp+ interfaces

Check IP Address 

None of your cards have a 172.28.5 address 
----- Original Message -----

From: "Bart Smink" <bartsmink@gmail.com> 
To: shorewall-users@lists.sourceforge.net 
Sent: Thursday, March 22, 2012 4:31:14 PM 
Subject: [Shorewall-users] Problems with reaching ppp+ interfaces 

Hi everyone, 

I am having some trouble with configuring the rules file for ppp+ interfaces.
The situation is as follows:

loc -> l2tp: 172.28.1.0/24 works 
loc -> l2tp: 172.28.5.0/24 ping fails with no route to host 

l2tp: 172.28.1.0/24 -> loc works 
l2tp: 172.28.5.0/24 -> loc fails with no route to host 
l2tp: 172.28.1.0/24 <-> l2tp: 172.28.5.0/24 works 


But I cannot find a configuration file where this restriction could come from. I
was thinking it had to be the routing table, but it shows no difference with the
other connection ppp0 that does work.

Routing table is as follows: 
Destination Gateway Genmask Flags Metric Ref Use Iface 
172.28.5.2 * 255.255.255.255 UH 0 0 0 ppp1 
172.28..1.10 * 255.255.255.255 UH 0 0 0 ppp0 
172.28.5.0 * 255.255.255.0 U 0 0 0 ppp1 
172.28.0.0 * 255.255.0.0 U 0 0 0 eth1 
129.125.0.0 * 255.255.0.0 U 0 0 0 eth0 
default 129.125.101.251 0.0.0.0 UG 0 0 0 eth0 

The ifconfig output: 
eth0 Link encap:Ethernet HWaddr 00:04:75:E5:5B:18 
inet addr:129.125.102.34 Bcast:129.125.255.255 Mask:255.255.0.0 
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 
RX packets:49113298 errors:0 dropped:0 overruns:436 frame:0 
TX packets:80804347 errors:0 dropped:0 overruns:0 carrier:0 
collisions:0 txqueuelen:1000 
RX bytes:729848396 (696.0 MiB) TX bytes:981895257 (936.4 MiB) 
Interrupt:201 Base address:0xe000 

eth1 Link encap:Ethernet HWaddr 00:0C:6E:3E:22:A9 
inet addr:172.28.1.1 Bcast:172.28.255.255 Mask:255.255.0.0 <--------------
Check IP address
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 
RX packets:80883923 errors:0 dropped:0 overruns:0 frame:0 
TX packets:44472324 errors:0 dropped:0 overruns:0 carrier:0 
collisions:0 txqueuelen:1000 
RX bytes:988163486 (942.3 MiB) TX bytes:30205189 (28.8 MiB) 
Interrupt:201 Base address:0x9800 

lo Link encap:Local Loopback 
inet addr:127.0.0.1 Mask:255.0.0.0 
UP LOOPBACK RUNNING MTU:16436 Metric:1 
RX packets:4453 errors:0 dropped:0 overruns:0 frame:0 
TX packets:4453 errors:0 dropped:0 overruns:0 carrier:0 
collisions:0 txqueuelen:0 
RX bytes:925463 (903.7 KiB) TX bytes:925463 (903.7 KiB) 

ppp0 Link encap:Point-to-Point Protocol 
inet addr:172.28.1.1 P-t-P:172.28.1.10 Mask:255.255.255.255
<-----------------Check IP address
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1400 Metric:1 
RX packets:6 errors:0 dropped:0 overruns:0 frame:0 
TX packets:5 errors:0 dropped:0 overruns:0 carrier:0 
collisions:0 txqueuelen:3 
RX bytes:138 (138.0 b) TX bytes:318 (318.0 b) 

ppp1 Link encap:Point-to-Point Protocol 
inet addr:172.28.1.1 P-t-P:172.28.5.2 Mask:255.255..255.255 <
-----------------Check IP address
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 
RX packets:1115 errors:0 dropped:0 overruns:0 frame:0 
TX packets:724 errors:0 dropped:0 overruns:0 carrier:0 
collisions:0 txqueuelen:3 
RX bytes:89559 (87.4 KiB) TX bytes:113560 (110.8 KiB) 


Here is the rules file: 
#l2tp 
ACCEPT l2tp: 172.28.0.0/16 fw 

ACCEPT l2tp: 172.28.1.0/24 l2tp: 172.28.0.0/16 
ACCEPT l2tp: 172.28.1.0/24 loc 
ACCEPT l2tp: 172.28.1.0/24 net 

ACCEPT l2tp: 172.28.2.0/24 l2tp: 172.28.2.0/24 

ACCEPT l2tp: 172.28.3..0/24 l2tp: 172.28.3.0/24 

ACCEPT l2tp: 172.28.4.0/24 l2tp: 172.28.4.0/24 

#ACCEPT l2tp: 172.28.5.0/24 l2tp: 172.28.5.0/24 
ACCEPT l2tp: 172.28.5.0/24 loc 
ACCEPT l2tp: 172.28.5.0/24 l2tp: 172.28.0.0/16 

#internet Access 
#ACCEPT l2tp: 172.28.4.0/24 net 
ACCEPT l2tp: 172.28.5.0/24 net 

#SMB 
ACCEPT l2tp: 172.28.3.0/24 loc: 172.28.1.101/32 tcp 445 - 
ACCEPT l2tp: 172.28.4.0/24 loc: 172.28.1.101/32 tcp 445 - 

#RDP 
ACCEPT l2tp: 172.28.3.0/24 loc: 172.28.1.107/32 tcp 3389 - 
ACCEPT l2tp: 172.28.4.0/24 loc: 172.28.1.107/32 tcp 3389 - 

and the policy file: 
#SOURCE DEST POLICY LOG LIMIT: CONNLIMIT: 
# LEVEL BURST MASK 
fw all ACCEPT 
loc all ACCEPT 
vpn all ACCEPT 
l2tp vpn ACCEPT 
l2tp fw ACCEPT 
l2tp all REJECT 7 
net all DROP 
all all REJECT 

The message in /var/log/messages that the reject rule is outputting is: 

Mar 22 21:50:44 gateway kernel: Shorewall:sfilter1:DROP:IN=eth1 OUT=eth1
SRC=172.28.1.102 DST=172.28.1.10 LEN=48 TOS=0x00 PREC=0x00 TTL=63 ID=58702 DF
PROTO=TCP SPT=53627 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0

But a ping command from 172.28.1.102 to 172.28.1.10 does work. 

Zones file is: 
fw firewall 
net ipv4 
loc ipv4 
vpn ipsec 
l2tp ipv4 

Interfaces; 
#ZONE INTERFACE BROADCAST OPTIONS 
net eth0 detect 
loc eth1 detect 
l2tp ppp+ - routeback 


I believe these are the most relevant items of a Shorewall dump. Also with these
settings I cannot find anything wrong, except the output situation. I would
really appreciate anyone''s help on this..

Greetings, 

Bart 


------------------------------------------------------------------------------ 
This SF email is sponsosred by: 
Try Windows Azure free for 90 days Click Here 
http://p.sf.net/sfu/sfd2d-msazure 
_______________________________________________ 
Shorewall-users mailing list 
Shorewall-users@lists.sourceforge.net 
https://lists.sourceforge.net/lists/listinfo/shorewall-users 



------------------------------------------------------------------------------
This SF email is sponsosred by:
Try Windows Azure free for 90 days Click Here 
http://p.sf.net/sfu/sfd2d-msazure

Bart Smink

2012-Mar-22 22:48 UTC

head link

Re: Problems with reaching ppp+ interfaces

Thanks Eric.

I have checked all ip addresses and I tried to change it somewhat, now the
PPPOE server is running on 172.28.5.1 and the client on ppp0 is on
172.28.5.2. The situation has not changed, it is still not possible to ping
to 172.28.5.0/24 and from it to anything other than WAN and the gateway.

The client on ppp1

The new ifconfig looks like:
eth0      Link encap:Ethernet  HWaddr 00:04:75:E5:5B:18
          inet addr:129.125.102.34  Bcast:129.125.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:64428091 errors:0 dropped:0 overruns:436 frame:0
          TX packets:113446207 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2261672255 (2.1 GiB)  TX bytes:840021628 (801.1 MiB)
          Interrupt:201 Base address:0xe000

eth1      Link encap:Ethernet  HWaddr 00:0C:6E:3E:22:A9
          inet addr:172.28.1.1  Bcast:172.28.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:113540491 errors:0 dropped:0 overruns:0 frame:0
          TX packets:58072037 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:847671674 (808.4 MiB)  TX bytes:1348983457 (1.2 GiB)
          Interrupt:201 Base address:0x9800

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:4693 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4693 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:954027 (931.6 KiB)  TX bytes:954027 (931.6 KiB)

ppp0      Link encap:Point-to-Point Protocol
          inet addr:172.28.5.1  P-t-P:172.28.5.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:135 errors:0 dropped:0 overruns:0 frame:0
          TX packets:114 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3
          RX bytes:10106 (9.8 KiB)  TX bytes:10668 (10.4 KiB)

ppp1      Link encap:Point-to-Point Protocol
          inet addr:172.28.1.1  P-t-P:172.28.1.10  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1400  Metric:1
          RX packets:10 errors:0 dropped:0 overruns:0 frame:0
          TX packets:9 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3
          RX bytes:298 (298.0 b)  TX bytes:526 (526.0 b)

And route shows:
Destination     Gateway         Genmask         Flags Metric Ref    Use
Iface
172.28.5.2      *               255.255.255.255 UH    0      0        0 ppp0
172.28.1.10     *               255.255.255.255 UH    0      0        0 ppp1
172.28.0.0      *               255.255.0.0     U     0      0        0 eth1
129.125.0.0     *               255.255.0.0     U     0      0        0 eth0
default         129.125.101.251 0.0.0.0         UG    0      0        0 eth0

I have looked up online that PPP does not set any routing from its
configuration, so the problems should come from iptables or routing.




2012/3/22 Eric Teeter <teetere@charter.net>
> Check IP Address
>
> None of your cards have a 172.28.5 address
> ------------------------------
> *From: *"Bart Smink" <bartsmink@gmail.com>
> *To: *shorewall-users@lists.sourceforge.net
> *Sent: *Thursday, March 22, 2012 4:31:14 PM
> *Subject: *[Shorewall-users] Problems with reaching ppp+ interfaces
>
>
> Hi everyone,
>
> I am having some trouble with configuring the rules file for ppp+
> interfaces. The situation is as follows:
>
> loc -> l2tp:172.28.1.0/24 works
> loc -> l2tp:172.28.5.0/24 ping fails with no route to host
>
> l2tp:172.28.1.0/24 -> loc works
> l2tp:172.28.5.0/24 -> loc fails with no route to host
> l2tp:172.28.1.0/24 <-> l2tp:172.28.5.0/24 works
>
>
> But I cannot find a configuration file where this restriction could come
> from. I was thinking it had to be the routing table, but it shows no
> difference with the other connection ppp0 that does work.
>
> Routing table is as follows:
> Destination     Gateway         Genmask         Flags Metric Ref    Use
> Iface
> 172.28.5.2      *                     255.255.255.255 UH    0
> 0        0 ppp1
> 172.28..1.10     *                    255.255.255.255 UH    0
> 0        0 ppp0
>
> 172.28.5.0      *                     255.255.255.0   U     0
> 0        0    ppp1
> 172.28.0.0      *                     255.255.0.0     U     0
> 0        0      eth1
> 129.125.0.0     *                     255.255.0.0     U     0      0
>     0    eth0
> default         129.125.101.251 0.0.0.0         UG    0      0
> 0    eth0
>
> The ifconfig output:
> eth0      Link encap:Ethernet  HWaddr 00:04:75:E5:5B:18
>           inet addr:129.125.102.34  Bcast:129.125.255.255  Mask:255.255.0.0
>           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
>           RX packets:49113298 errors:0 dropped:0 overruns:436 frame:0
>           TX packets:80804347 errors:0 dropped:0 overruns:0 carrier:0
>           collisions:0 txqueuelen:1000
>           RX bytes:729848396 (696.0 MiB)  TX bytes:981895257 (936.4 MiB)
>           Interrupt:201 Base address:0xe000
>
> eth1      Link encap:Ethernet  HWaddr 00:0C:6E:3E:22:A9
>           inet addr:172.28.1.1  Bcast:172.28.255.255  Mask:255.255.0.0
> <-------------- Check IP address
>
>           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
>           RX packets:80883923 errors:0 dropped:0 overruns:0 frame:0
>           TX packets:44472324 errors:0 dropped:0 overruns:0 carrier:0
>           collisions:0 txqueuelen:1000
>           RX bytes:988163486 (942.3 MiB)  TX bytes:30205189 (28.8 MiB)
>           Interrupt:201 Base address:0x9800
>
> lo        Link encap:Local Loopback
>           inet addr:127.0.0.1  Mask:255.0.0.0
>           UP LOOPBACK RUNNING  MTU:16436  Metric:1
>           RX packets:4453 errors:0 dropped:0 overruns:0 frame:0
>           TX packets:4453 errors:0 dropped:0 overruns:0 carrier:0
>           collisions:0 txqueuelen:0
>           RX bytes:925463 (903.7 KiB)  TX bytes:925463 (903.7 KiB)
>
> ppp0      Link encap:Point-to-Point Protocol
>           inet addr:172.28.1.1  P-t-P:172.28.1.10  Mask:255.255.255.255
> <-----------------Check IP address
>
>           UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1400  Metric:1
>           RX packets:6 errors:0 dropped:0 overruns:0 frame:0
>           TX packets:5 errors:0 dropped:0 overruns:0 carrier:0
>           collisions:0 txqueuelen:3
>           RX bytes:138 (138.0 b)  TX bytes:318 (318.0 b)
>
> ppp1      Link encap:Point-to-Point Protocol
>           inet addr:172.28.1.1  P-t-P:172.28.5.2  Mask:255.255..255.255
<
> -----------------Check IP address
>
>           UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
>           RX packets:1115 errors:0 dropped:0 overruns:0 frame:0
>           TX packets:724 errors:0 dropped:0 overruns:0 carrier:0
>           collisions:0 txqueuelen:3
>           RX bytes:89559 (87.4 KiB)  TX bytes:113560 (110.8 KiB)
>
>
> Here is the rules file:
> #l2tp
> ACCEPT       l2tp:172.28.0.0/16  fw
>
> ACCEPT       l2tp:172.28.1.0/24 l2tp:172.28.0.0/16
> ACCEPT       l2tp:172.28.1.0/24 loc
> ACCEPT       l2tp:172.28.1.0/24 net
>
> ACCEPT       l2tp:172.28.2.0/24 l2tp:172.28.2.0/24
>
> ACCEPT       l2tp:172.28.3..0/24 <http://172.28.3.0/24>
l2tp:172.28.3.0/24
>
>
> ACCEPT       l2tp:172.28.4.0/24 l2tp:172.28.4.0/24
>
> #ACCEPT       l2tp:172.28.5.0/24 l2tp:172.28.5.0/24
> ACCEPT       l2tp:172.28.5.0/24 loc
> ACCEPT       l2tp:172.28.5.0/24 l2tp:172.28.0.0/16
>
> #internet Access
> #ACCEPT       l2tp:172.28.4.0/24 net
> ACCEPT        l2tp:172.28.5.0/24 net
>
> #SMB
> ACCEPT       l2tp:172.28.3.0/24 loc:172.28.1.101/32 tcp  445 -
> ACCEPT       l2tp:172.28.4.0/24 loc:172.28.1.101/32 tcp  445 -
>
> #RDP
> ACCEPT       l2tp:172.28.3.0/24 loc:172.28.1.107/32 tcp 3389 -
> ACCEPT       l2tp:172.28.4.0/24 loc:172.28.1.107/32 tcp 3389 -
>
> and the policy file:
> #SOURCE DEST    POLICY          LOG     LIMIT:          CONNLIMIT:
> #                               LEVEL   BURST           MASK
> fw      all     ACCEPT
> loc     all     ACCEPT
> vpn     all     ACCEPT
> l2tp    vpn     ACCEPT
> l2tp    fw      ACCEPT
> l2tp    all     REJECT        7
> net     all     DROP
> all     all     REJECT
>
> The message in /var/log/messages that the reject rule is outputting is:
>
> Mar 22 21:50:44 gateway kernel: Shorewall:sfilter1:DROP:IN=eth1 OUT=eth1
> SRC=172.28.1.102 DST=172.28.1.10 LEN=48 TOS=0x00 PREC=0x00 TTL=63 ID=58702
> DF PROTO=TCP SPT=53627 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
>
> But a ping command from 172.28.1.102 to 172.28.1.10 does work.
>
> Zones file is:
> fw      firewall
> net     ipv4
> loc     ipv4
> vpn     ipsec
> l2tp    ipv4
>
> Interfaces;
> #ZONE   INTERFACE       BROADCAST       OPTIONS
> net     eth0            detect
> loc     eth1            detect
> l2tp    ppp+            -               routeback
>
>
> I believe these are the most relevant items of a Shorewall dump. Also with
> these settings I cannot find anything wrong, except the output situation. I
> would really appreciate anyone''s help on this..
>
> Greetings,
>
> Bart
>
>
>
>
------------------------------------------------------------------------------
> This SF email is sponsosred by:
> Try Windows Azure free for 90 days Click Here
> http://p.sf.net/sfu/sfd2d-msazure
> _______________________________________________
> Shorewall-users mailing list
> Shorewall-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/shorewall-users
>
>
>
>
------------------------------------------------------------------------------
> This SF email is sponsosred by:
> Try Windows Azure free for 90 days Click Here
> http://p.sf.net/sfu/sfd2d-msazure
> _______________________________________________
> Shorewall-users mailing list
> Shorewall-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/shorewall-users
>
>

-- 
**** DISCLAIMER ****

"This e-mail and any attachment thereto may contain information which is
confidential and/or protected by intellectual property rights and are
intended for the sole use of the recipient(s) named above.
Any use of the information contained herein (including, but not limited to,
total or partial reproduction, communication or distribution in any form)
by other persons than the designated recipient(s) is prohibited.
If you have received this e-mail in error, please notify the sender either
by telephone or by e-mail and delete the material from any computer".

Thank you for your cooperation.


------------------------------------------------------------------------------
This SF email is sponsosred by:
Try Windows Azure free for 90 days Click Here 
http://p.sf.net/sfu/sfd2d-msazure

Shorewall users - Mar 2012 - Problems with reaching ppp+ interfaces

Problems with reaching ppp+ interfaces

Re: Problems with reaching ppp+ interfaces

Re: Problems with reaching ppp+ interfaces