|
Hi all, it's not an explicit shorewall thing, but I'm very desperate at the moment and hope that someone here has a good idea or hint for me. On a shorewall firewall system I have a little VMware image running, only purpose is to act as IPsec gateway. Let's call it vpnbox. Of course on the vpnbox is also running shorewall, but only with a few policies, the main firewall work is done on the underlying firewall system. Now I want to migrate this VMware instance to a XEN instance (I want to get rid of VMware, with every kernel upgrade I have to compile it again). So I installed a new host as dom0, put the same firewall rules on it as on the original, and converted the VMware image to a XEN image. So, only difference of old and new vpnbox are xen kernel and modules. To migrate the IPsec service I took down the IPsec daemon and outside IP on the old vpnbox, activated same IP on the new one, restarted shorewall, added routing rules and started the IPsec daemon. After adjusting the routing rules at our central router new connections should now go over the new system. So I started to ping a host over an IPsec route, but I get no answer. On the new vpnbox I can see that racoon is opening the IPsec tunnel, and I have the same entries in the shorewall log as on the old system: Dec 28 18:08:56 vpnbox kernel: Shorewall:loc2vpn:ACCEPT:IN=eth0 OUT=eth2 SRC="" DST=10.113.2.16 LEN=84 TOS=0x00 PREC=0x00 TTL=62 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=3434 SEQ=4 So, what could be the reason that this thing doesn't work with XEN? Is there perhaps any difference between a VMware bridge and a XEN bridge? What information can I provide further? The Dom0 is a debian lenny, the vpnbox a debian etch ( I tried before with a fresh installed lenny domU with same result). What drives me crazy is the fact, that the IPsec tunnels gets established on an arriving request, but then the traffic seems not to be routed into the tunnel. Or is this assumption wrong? I'm facing with this problem for weeks now, I don't have any clue what could be wrong. I also watched the traffic with wireshark, but I only saw the incoming packets (perspective of the vpnbox), but no answers. So, if one of you guys have a hint for me, where to look or what to change, I would be very happy. Attached a shorewall dump. It was made when I tried to reach IPs 10.113.2.x (by ping and other) and to reach 83.97.7.196 by ssh, both without success. Regards, Christian |
Shorewall 4.0.15 Dump at vpnbox.opti-serv.bruchsal - Mi 2. Feb 19:39:20 CET 2011
Shorewall-perl 4.0.15
Counters reset Mi 2. Feb 19:31:14 CET 2011
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
693 101K eth2_in 0 -- eth2 * 0.0.0.0/0 0.0.0.0/0
2669 243K eth0_in 0 -- eth0 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
0 0 Drop 0 -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix `Shorewall:INPUT:DROP:'
0 0 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
622 50268 eth2_fwd 0 -- eth2 * 0.0.0.0/0 0.0.0.0/0
591 48512 eth0_fwd 0 -- eth0 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
0 0 Drop 0 -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix `Shorewall:FORWARD:DROP:'
0 0 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
934 127K eth2_out 0 -- * eth2 0.0.0.0/0 0.0.0.0/0
2321 2373K eth0_out 0 -- * eth0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- * lo 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
0 0 Drop 0 -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix `Shorewall:OUTPUT:DROP:'
0 0 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain Drop (8 references)
pkts bytes target prot opt in out source destination
0 0 reject tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:113
0 0 dropBcast 0 -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
icmp type 3 code 4
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
icmp type 11
0 0 dropInvalid 0 -- * * 0.0.0.0/0 0.0.0.0/0
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
multiport dports 135,445
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpts:137:139
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
udp spt:137 dpts:1024:65535
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0
multiport dports 135,139,445
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:1900
0 0 dropNotSyn tcp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
udp spt:53
Chain Reject (0 references)
pkts bytes target prot opt in out source destination
0 0 reject tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:113
0 0 dropBcast 0 -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
icmp type 3 code 4
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
icmp type 11
0 0 dropInvalid 0 -- * * 0.0.0.0/0 0.0.0.0/0
0 0 reject udp -- * * 0.0.0.0/0 0.0.0.0/0
multiport dports 135,445
0 0 reject udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpts:137:139
0 0 reject udp -- * * 0.0.0.0/0 0.0.0.0/0
udp spt:137 dpts:1024:65535
0 0 reject tcp -- * * 0.0.0.0/0 0.0.0.0/0
multiport dports 135,139,445
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:1900
0 0 dropNotSyn tcp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
udp spt:53
Chain dropBcast (2 references)
pkts bytes target prot opt in out source destination
0 0 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
ADDRTYPE match dst-type BROADCAST
0 0 DROP 0 -- * * 0.0.0.0/0 224.0.0.0/4
Chain dropInvalid (2 references)
pkts bytes target prot opt in out source destination
0 0 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
state INVALID
Chain dropNotSyn (2 references)
pkts bytes target prot opt in out source destination
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp flags:!0x17/0x02
Chain dynamic (4 references)
pkts bytes target prot opt in out source destination
Chain eth0_fwd (1 references)
pkts bytes target prot opt in out source destination
558 46552 dynamic 0 -- * * 0.0.0.0/0 0.0.0.0/0
state INVALID,NEW
0 0 loc2net 0 -- * eth2 0.0.0.0/0 0.0.0.0/0
policy match dir out pol none
3 180 loc2vpn 0 -- * eth2 0.0.0.0/0 83.97.7.196
policy match dir out pol ipsec
0 0 loc2vpn 0 -- * eth2 0.0.0.0/0 83.97.6.169
policy match dir out pol ipsec
0 0 loc2vpn 0 -- * eth2 0.0.0.0/0
62.214.101.6 policy match dir out pol ipsec
0 0 loc2vpn 0 -- * eth2 0.0.0.0/0
10.231.20.108 policy match dir out pol ipsec
0 0 loc2vpn 0 -- * eth2 0.0.0.0/0
194.145.239.250 policy match dir out pol ipsec
588 48332 loc2vpn 0 -- * eth2 0.0.0.0/0
10.113.2.0/24 policy match dir out pol ipsec
Chain eth0_in (1 references)
pkts bytes target prot opt in out source destination
1847 190K dynamic 0 -- * * 0.0.0.0/0 0.0.0.0/0
state INVALID,NEW
2669 243K loc2fw 0 -- * * 0.0.0.0/0 0.0.0.0/0
policy match dir in pol none
Chain eth0_out (1 references)
pkts bytes target prot opt in out source destination
2321 2373K fw2loc 0 -- * * 0.0.0.0/0 0.0.0.0/0
policy match dir out pol none
Chain eth2_fwd (1 references)
pkts bytes target prot opt in out source destination
0 0 dynamic 0 -- * * 0.0.0.0/0 0.0.0.0/0
state INVALID,NEW
8 480 vpn_frwd 0 -- * * 83.97.7.196 0.0.0.0/0
policy match dir in pol ipsec
0 0 vpn_frwd 0 -- * * 83.97.6.169 0.0.0.0/0
policy match dir in pol ipsec
0 0 vpn_frwd 0 -- * * 62.214.101.6 0.0.0.0/0
policy match dir in pol ipsec
0 0 vpn_frwd 0 -- * * 10.231.20.108 0.0.0.0/0
policy match dir in pol ipsec
0 0 vpn_frwd 0 -- * * 194.145.239.250 0.0.0.0/0
policy match dir in pol ipsec
614 49788 vpn_frwd 0 -- * * 10.113.2.0/24 0.0.0.0/0
policy match dir in pol ipsec
0 0 net2loc 0 -- * eth0 0.0.0.0/0 0.0.0.0/0
policy match dir out pol none
0 0 net2vpn 0 -- * eth2 0.0.0.0/0 83.97.7.196
policy match dir out pol ipsec
0 0 net2vpn 0 -- * eth2 0.0.0.0/0 83.97.6.169
policy match dir out pol ipsec
0 0 net2vpn 0 -- * eth2 0.0.0.0/0
62.214.101.6 policy match dir out pol ipsec
0 0 net2vpn 0 -- * eth2 0.0.0.0/0
10.231.20.108 policy match dir out pol ipsec
0 0 net2vpn 0 -- * eth2 0.0.0.0/0
194.145.239.250 policy match dir out pol ipsec
0 0 net2vpn 0 -- * eth2 0.0.0.0/0
10.113.2.0/24 policy match dir out pol ipsec
Chain eth2_in (1 references)
pkts bytes target prot opt in out source destination
0 0 dynamic 0 -- * * 0.0.0.0/0 0.0.0.0/0
state INVALID,NEW
693 101K net2fw 0 -- * * 0.0.0.0/0 0.0.0.0/0
policy match dir in pol none
0 0 vpn2fw 0 -- * * 83.97.7.196 0.0.0.0/0
policy match dir in pol ipsec
0 0 vpn2fw 0 -- * * 83.97.6.169 0.0.0.0/0
policy match dir in pol ipsec
0 0 vpn2fw 0 -- * * 62.214.101.6 0.0.0.0/0
policy match dir in pol ipsec
0 0 vpn2fw 0 -- * * 10.231.20.108 0.0.0.0/0
policy match dir in pol ipsec
0 0 vpn2fw 0 -- * * 194.145.239.250 0.0.0.0/0
policy match dir in pol ipsec
0 0 vpn2fw 0 -- * * 10.113.2.0/24 0.0.0.0/0
policy match dir in pol ipsec
Chain eth2_out (1 references)
pkts bytes target prot opt in out source destination
934 127K fw2net 0 -- * * 0.0.0.0/0 0.0.0.0/0
policy match dir out pol none
0 0 fw2vpn 0 -- * * 0.0.0.0/0 83.97.7.196
policy match dir out pol ipsec
0 0 fw2vpn 0 -- * * 0.0.0.0/0 83.97.6.169
policy match dir out pol ipsec
0 0 fw2vpn 0 -- * * 0.0.0.0/0
62.214.101.6 policy match dir out pol ipsec
0 0 fw2vpn 0 -- * * 0.0.0.0/0
10.231.20.108 policy match dir out pol ipsec
0 0 fw2vpn 0 -- * * 0.0.0.0/0
194.145.239.250 policy match dir out pol ipsec
0 0 fw2vpn 0 -- * * 0.0.0.0/0
10.113.2.0/24 policy match dir out pol ipsec
Chain fw2loc (1 references)
pkts bytes target prot opt in out source destination
669 149K ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
1652 2224K ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain fw2net (1 references)
pkts bytes target prot opt in out source destination
930 126K ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
1 112 ACCEPT esp -- * * 0.0.0.0/0 83.97.6.169
1 128 ACCEPT udp -- * * 0.0.0.0/0 83.97.6.169
udp dpt:500 state NEW
0 0 ACCEPT esp -- * * 0.0.0.0/0
62.214.101.6
0 0 ACCEPT udp -- * * 0.0.0.0/0
62.214.101.6 udp dpt:500 state NEW
1 152 ACCEPT esp -- * * 0.0.0.0/0
194.145.239.250
1 132 ACCEPT udp -- * * 0.0.0.0/0
194.145.239.250 udp dpt:500 state NEW
0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain fw2vpn (6 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain loc2fw (1 references)
pkts bytes target prot opt in out source destination
822 53724 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
1847 190K ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain loc2net (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain loc2vpn (6 references)
pkts bytes target prot opt in out source destination
33 1960 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
558 46552 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain logdrop (0 references)
pkts bytes target prot opt in out source destination
0 0 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain logreject (0 references)
pkts bytes target prot opt in out source destination
0 0 reject 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain net2fw (1 references)
pkts bytes target prot opt in out source destination
693 101K ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:500
0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:500 LOG flags 0 level 6 prefix `Shorewall:net2fw:ACCEPT:'
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:500
0 0 ACCEPT esp -- * * 83.97.6.169 0.0.0.0/0
0 0 ACCEPT udp -- * * 83.97.6.169 0.0.0.0/0
udp dpt:500 state NEW
0 0 ACCEPT esp -- * * 62.214.101.6 0.0.0.0/0
0 0 ACCEPT udp -- * * 62.214.101.6 0.0.0.0/0
udp dpt:500 state NEW
0 0 ACCEPT esp -- * * 194.145.239.250 0.0.0.0/0
0 0 ACCEPT udp -- * * 194.145.239.250 0.0.0.0/0
udp dpt:500 state NEW
0 0 Drop 0 -- * * 0.0.0.0/0 0.0.0.0/0
0 0 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain net2loc (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
0 0 Drop 0 -- * * 0.0.0.0/0 0.0.0.0/0
0 0 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain net2vpn (6 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
0 0 Drop 0 -- * * 0.0.0.0/0 0.0.0.0/0
0 0 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain reject (7 references)
pkts bytes target prot opt in out source destination
0 0 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
ADDRTYPE match src-type BROADCAST
0 0 DROP 0 -- * * 224.0.0.0/4 0.0.0.0/0
0 0 DROP 2 -- * * 0.0.0.0/0 0.0.0.0/0
0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0
reject-with tcp-reset
0 0 REJECT udp -- * * 0.0.0.0/0 0.0.0.0/0
reject-with icmp-port-unreachable
0 0 REJECT icmp -- * * 0.0.0.0/0 0.0.0.0/0
reject-with icmp-host-unreachable
0 0 REJECT 0 -- * * 0.0.0.0/0 0.0.0.0/0
reject-with icmp-host-prohibited
Chain shorewall (0 references)
pkts bytes target prot opt in out source destination
Chain smurfs (0 references)
pkts bytes target prot opt in out source destination
0 0 RETURN 0 -- * * 0.0.0.0 0.0.0.0/0
0 0 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0
ADDRTYPE match src-type BROADCAST LOG flags 0 level 6 prefix
`Shorewall:smurfs:DROP:'
0 0 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
ADDRTYPE match src-type BROADCAST
0 0 LOG 0 -- * * 224.0.0.0/4 0.0.0.0/0
LOG flags 0 level 6 prefix `Shorewall:smurfs:DROP:'
0 0 DROP 0 -- * * 224.0.0.0/4 0.0.0.0/0
Chain vpn2fw (6 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
0 0 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix `Shorewall:vpn2fw:ACCEPT:'
0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain vpn2loc (1 references)
pkts bytes target prot opt in out source destination
622 50268 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
0 0 ACCEPT icmp -- * * 10.231.20.108
10.231.113.33
0 0 ACCEPT tcp -- * * 10.231.20.108
10.231.113.33 tcp dpt:80
0 0 ACCEPT tcp -- * * 10.231.20.108
10.231.113.33 tcp dpt:443
0 0 ACCEPT icmp -- * * 10.113.2.250 10.3.0.17
0 0 ACCEPT 0 -- * * 192.168.0.0/24 0.0.0.0/0
0 0 Drop 0 -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix `Shorewall:vpn2loc:DROP:'
0 0 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain vpn2net (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
0 0 Drop 0 -- * * 0.0.0.0/0 0.0.0.0/0
0 0 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain vpn_frwd (6 references)
pkts bytes target prot opt in out source destination
0 0 vpn2net 0 -- * eth2 0.0.0.0/0 0.0.0.0/0
policy match dir out pol none
622 50268 vpn2loc 0 -- * eth0 0.0.0.0/0 0.0.0.0/0
policy match dir out pol none
Log (/var/log/messages)
NAT Table
Chain PREROUTING (policy ACCEPT 861 packets, 108K bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 561 packets, 46936 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 4 packets, 468 bytes)
pkts bytes target prot opt in out source destination
Mangle Table
Chain PREROUTING (policy ACCEPT 4879 packets, 505K bytes)
pkts bytes target prot opt in out source destination
4879 505K tcpre 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain INPUT (policy ACCEPT 3362 packets, 344K bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 1213 packets, 98780 bytes)
pkts bytes target prot opt in out source destination
1213 98780 tcfor 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 3255 packets, 2500K bytes)
pkts bytes target prot opt in out source destination
3255 2500K tcout 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain POSTROUTING (policy ACCEPT 4468 packets, 2599K bytes)
pkts bytes target prot opt in out source destination
4468 2599K tcpost 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain tcfor (1 references)
pkts bytes target prot opt in out source destination
Chain tcout (1 references)
pkts bytes target prot opt in out source destination
Chain tcpost (1 references)
pkts bytes target prot opt in out source destination
Chain tcpre (1 references)
pkts bytes target prot opt in out source destination
Conntrack Table
udp 17 151 src=10.3.0.2 dst=78.46.108.116 sport=123 dport=123 packets=34
bytes=2584 src=78.46.108.116 dst=10.3.0.2 sport=123 dport=123 packets=34
bytes=2584 [ASSURED] mark=0 use=1
udp 17 74 src=85.115.25.93 dst=83.97.6.169 sport=500 dport=500 packets=6
bytes=808 src=83.97.6.169 dst=85.115.25.93 sport=500 dport=500 packets=6
bytes=792 [ASSURED] mark=0 use=1
tcp 6 16 SYN_RECV src=10.3.0.17 dst=10.113.2.23 sport=49566 dport=1433
packets=1 bytes=60 src=10.113.2.23 dst=10.3.0.17 sport=1433 dport=49566
packets=9 bytes=528 mark=0 use=1
tcp 6 35 SYN_RECV src=10.3.0.17 dst=10.113.2.23 sport=49638 dport=1433
packets=1 bytes=60 src=10.113.2.23 dst=10.3.0.17 sport=1433 dport=49638
packets=9 bytes=528 mark=0 use=1
tcp 6 50 SYN_RECV src=10.3.0.9 dst=83.97.7.196 sport=44151 dport=22
packets=1 bytes=60 src=83.97.7.196 dst=10.3.0.9 sport=22 dport=44151 packets=8
bytes=480 mark=0 use=1
udp 17 155 src=10.3.0.2 dst=188.40.91.104 sport=123 dport=123 packets=34
bytes=2584 src=188.40.91.104 dst=10.3.0.2 sport=123 dport=123 packets=34
bytes=2584 [ASSURED] mark=0 use=1
udp 17 158 src=10.3.0.2 dst=192.53.103.108 sport=123 dport=123 packets=34
bytes=2584 src=192.53.103.108 dst=10.3.0.2 sport=123 dport=123 packets=34
bytes=2584 [ASSURED] mark=0 use=1
unknown 50 590 src=85.115.25.93 dst=83.97.6.169 packets=3 bytes=336
src=83.97.6.169 dst=85.115.25.93 packets=8 bytes=896 mark=0 use=1
tcp 6 431999 ESTABLISHED src=10.3.0.1 dst=10.3.0.2 sport=37075 dport=22
packets=1713 bytes=116972 src=10.3.0.2 dst=10.3.0.1 sport=22 dport=37075
packets=1274 bytes=259644 [ASSURED] mark=0 use=1
udp 17 175 src=85.115.25.93 dst=194.145.239.250 sport=500 dport=500
packets=140 bytes=18120 src=194.145.239.250 dst=85.115.25.93 sport=500
dport=500 packets=65 bytes=8232 [ASSURED] mark=0 use=1
tcp 6 431287 ESTABLISHED src=10.3.0.2 dst=192.168.222.60 sport=59028
dport=6001 packets=1203 bytes=2193072 src=192.168.222.60 dst=10.3.0.2
sport=6001 dport=59028 packets=1396 bytes=138188 [ASSURED] mark=0 use=1
udp 17 151 src=10.3.0.2 dst=178.63.212.146 sport=123 dport=123 packets=34
bytes=2584 src=178.63.212.146 dst=10.3.0.2 sport=123 dport=123 packets=34
bytes=2584 [ASSURED] mark=0 use=1
unknown 50 599 src=85.115.25.93 dst=194.145.239.250 packets=588 bytes=88000
src=194.145.239.250 dst=85.115.25.93 packets=614 bytes=91120 mark=0 use=1
IP Configuration
1: lo: <LOOPBACK,UP,10000> mtu 16436 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:16:3e:00:00:1c brd ff:ff:ff:ff:ff:ff
inet 10.3.0.2/24 brd 10.3.0.255 scope global eth0
inet6 fe80::216:3eff:fe00:1c/64 scope link
valid_lft forever preferred_lft forever
3: eth2: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:16:3e:00:00:1d brd ff:ff:ff:ff:ff:ff
inet 85.115.25.93/28 brd 85.115.25.95 scope global eth2
inet6 fe80::216:3eff:fe00:1d/64 scope link
valid_lft forever preferred_lft forever
4: sit0: <NOARP> mtu 1480 qdisc noop
link/sit 0.0.0.0 brd 0.0.0.0
IP Stats
1: lo: <LOOPBACK,UP,10000> mtu 16436 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
RX: bytes packets errors dropped overrun mcast
0 0 0 0 0 0
TX: bytes packets errors dropped carrier collsns
0 0 0 0 0 0
2: eth0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:16:3e:00:00:1c brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
8653254 16290 0 0 0 0
TX: bytes packets errors dropped carrier collsns
10137958 10657 0 0 0 0
3: eth2: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:16:3e:00:00:1d brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
238934 1162 0 0 0 0
TX: bytes packets errors dropped carrier collsns
125622 1109 0 0 0 0
4: sit0: <NOARP> mtu 1480 qdisc noop
link/sit 0.0.0.0 brd 0.0.0.0
RX: bytes packets errors dropped overrun mcast
0 0 0 0 0 0
TX: bytes packets errors dropped carrier collsns
0 0 0 0 0 0
PFKEY SPD
10.231.20.108[any] 10.231.113.32/28[any] any
in ipsec
esp/tunnel/62.214.101.6-85.115.25.93/unique#16386
created: Feb 2 19:19:48 2011 lastused:
lifetime: 0(s) validtime: 0(s)
spid=136 seq=16 pid=2563
refcnt=1
10.113.2.0/24[any] 10.3.0.16/29[any] any
in ipsec
esp/tunnel/194.145.239.250-85.115.25.93/require
created: Feb 2 19:19:48 2011 lastused:
lifetime: 0(s) validtime: 0(s)
spid=168 seq=15 pid=2563
refcnt=1
83.97.7.192/28[any] 10.3.0.8/29[any] any
in ipsec
esp/tunnel/83.97.6.169-85.115.25.93/require
created: Feb 2 19:19:48 2011 lastused:
lifetime: 0(s) validtime: 0(s)
spid=192 seq=14 pid=2563
refcnt=1
83.97.6.169[any] 85.115.25.93[any] any
in ipsec
esp/tunnel/83.97.6.169-85.115.25.93/require
created: Feb 2 19:19:48 2011 lastused:
lifetime: 0(s) validtime: 0(s)
spid=216 seq=13 pid=2563
refcnt=1
0.0.0.0[any] 85.115.25.93[any] any
in ipsec
esp/tunnel/0.0.0.0-85.115.25.93/require
created: Feb 2 19:19:48 2011 lastused:
lifetime: 0(s) validtime: 0(s)
spid=240 seq=12 pid=2563
refcnt=1
10.231.113.32/28[any] 10.231.20.108[any] any
out ipsec
esp/tunnel/85.115.25.93-62.214.101.6/unique#16387
created: Feb 2 19:19:48 2011 lastused:
lifetime: 0(s) validtime: 0(s)
spid=153 seq=11 pid=2563
refcnt=1
10.3.0.16/29[any] 10.113.2.0/24[any] any
out ipsec
esp/tunnel/85.115.25.93-194.145.239.250/require
created: Feb 2 19:19:48 2011 lastused: Feb 2 19:39:20 2011
lifetime: 0(s) validtime: 0(s)
spid=161 seq=10 pid=2563
refcnt=26
10.3.0.8/29[any] 83.97.7.192/28[any] any
out ipsec
esp/tunnel/85.115.25.93-83.97.6.169/require
created: Feb 2 19:19:48 2011 lastused: Feb 2 19:37:55 2011
lifetime: 0(s) validtime: 0(s)
spid=185 seq=9 pid=2563
refcnt=2
85.115.25.93[any] 83.97.6.169[any] any
out ipsec
esp/tunnel/85.115.25.93-83.97.6.169/require
created: Feb 2 19:19:48 2011 lastused:
lifetime: 0(s) validtime: 0(s)
spid=209 seq=8 pid=2563
refcnt=1
85.115.25.93[any] 0.0.0.0[any] any
out ipsec
esp/tunnel/85.115.25.93-0.0.0.0/require
created: Feb 2 19:19:48 2011 lastused:
lifetime: 0(s) validtime: 0(s)
spid=233 seq=7 pid=2563
refcnt=1
10.231.20.108[any] 10.231.113.32/28[any] any
fwd ipsec
esp/tunnel/62.214.101.6-85.115.25.93/require
created: Feb 2 19:19:48 2011 lastused:
lifetime: 0(s) validtime: 0(s)
spid=146 seq=6 pid=2563
refcnt=1
10.113.2.0/24[any] 10.3.0.16/29[any] any
fwd ipsec
esp/tunnel/194.145.239.250-85.115.25.93/require
created: Feb 2 19:19:48 2011 lastused: Feb 2 19:39:20 2011
lifetime: 0(s) validtime: 0(s)
spid=178 seq=5 pid=2563
refcnt=21
83.97.7.192/28[any] 10.3.0.8/29[any] any
fwd ipsec
esp/tunnel/83.97.6.169-85.115.25.93/require
created: Feb 2 19:19:48 2011 lastused: Feb 2 19:39:11 2011
lifetime: 0(s) validtime: 0(s)
spid=202 seq=4 pid=2563
refcnt=2
83.97.6.169[any] 85.115.25.93[any] any
fwd ipsec
esp/tunnel/83.97.6.169-85.115.25.93/require
created: Feb 2 19:19:48 2011 lastused:
lifetime: 0(s) validtime: 0(s)
spid=226 seq=3 pid=2563
refcnt=1
0.0.0.0[any] 85.115.25.93[any] any
fwd ipsec
esp/tunnel/0.0.0.0-85.115.25.93/require
created: Feb 2 19:19:48 2011 lastused:
lifetime: 0(s) validtime: 0(s)
spid=250 seq=2 pid=2563
refcnt=1
(per-socket policy)
in none
created: Feb 2 19:19:53 2011 lastused: Feb 2 19:39:16 2011
lifetime: 0(s) validtime: 0(s)
spid=259 seq=1 pid=2563
refcnt=1
(per-socket policy)
out none
created: Feb 2 19:19:53 2011 lastused: Feb 2 19:39:16 2011
lifetime: 0(s) validtime: 0(s)
spid=268 seq=0 pid=2563
refcnt=1
PFKEY SAD
83.97.6.169 85.115.25.93
esp mode=tunnel spi=120834145(0x0733c861) reqid=0(0x00000000)
seq=0x00000000 replay=4 flags=0x00000000 state=mature
created: Feb 2 19:37:35 2011 current: Feb 2 19:39:20 2011
diff: 105(s) hard: 28800(s) soft: 23040(s)
last: Feb 2 19:37:37 2011 hard: 0(s) soft: 0(s)
current: 480(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 8 hard: 0 soft: 0
sadb_seq=3 pid=2564 refcnt=0
194.145.239.250 85.115.25.93
esp mode=tunnel spi=265094337(0x0fcd04c1) reqid=0(0x00000000)
seq=0x00000000 replay=4 flags=0x00000000 state=mature
created: Feb 2 19:34:15 2011 current: Feb 2 19:39:20 2011
diff: 305(s) hard: 3600(s) soft: 2880(s)
last: Feb 2 19:34:15 2011 hard: 0(s) soft: 0(s)
current: 49788(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 614 hard: 0 soft: 0
sadb_seq=2 pid=2564 refcnt=0
85.115.25.93 194.145.239.250
esp mode=tunnel spi=1745571369(0x680b4e29) reqid=0(0x00000000)
seq=0x00000000 replay=4 flags=0x00000000 state=mature
created: Feb 2 19:34:15 2011 current: Feb 2 19:39:20 2011
diff: 305(s) hard: 3600(s) soft: 2880(s)
last: Feb 2 19:34:15 2011 hard: 0(s) soft: 0(s)
current: 88000(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 588 hard: 0 soft: 0
sadb_seq=1 pid=2564 refcnt=0
85.115.25.93 83.97.6.169
esp mode=tunnel spi=904876742(0x35ef52c6) reqid=0(0x00000000)
seq=0x00000000 replay=4 flags=0x00000000 state=mature
created: Feb 2 19:37:35 2011 current: Feb 2 19:39:20 2011
diff: 105(s) hard: 28800(s) soft: 23040(s)
last: Feb 2 19:37:37 2011 hard: 0(s) soft: 0(s)
current: 336(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 3 hard: 0 soft: 0
sadb_seq=0 pid=2564 refcnt=0
/proc
/proc/version = Linux version 2.6.18-6-xen-686 (Debian
2.6.18.dfsg.1-26etch2) ([email protected]) (gcc version 4.1.2 20061115
(prerelease) (Debian 4.1.1-21)) #1 SMP Sat Feb 20 01:44:14 UTC 2010
/proc/sys/net/ipv4/ip_forward = 1
/proc/sys/net/ipv4/icmp_echo_ignore_all = 0
/proc/sys/net/ipv4/conf/all/proxy_arp = 0
/proc/sys/net/ipv4/conf/all/arp_filter = 0
/proc/sys/net/ipv4/conf/all/arp_ignore = 0
/proc/sys/net/ipv4/conf/all/rp_filter = 1
/proc/sys/net/ipv4/conf/all/log_martians = 0
/proc/sys/net/ipv4/conf/default/proxy_arp = 0
/proc/sys/net/ipv4/conf/default/arp_filter = 0
/proc/sys/net/ipv4/conf/default/arp_ignore = 0
/proc/sys/net/ipv4/conf/default/rp_filter = 1
/proc/sys/net/ipv4/conf/default/log_martians = 0
/proc/sys/net/ipv4/conf/eth0/proxy_arp = 0
/proc/sys/net/ipv4/conf/eth0/arp_filter = 0
/proc/sys/net/ipv4/conf/eth0/arp_ignore = 0
/proc/sys/net/ipv4/conf/eth0/rp_filter = 1
/proc/sys/net/ipv4/conf/eth0/log_martians = 0
/proc/sys/net/ipv4/conf/eth2/proxy_arp = 0
/proc/sys/net/ipv4/conf/eth2/arp_filter = 0
/proc/sys/net/ipv4/conf/eth2/arp_ignore = 0
/proc/sys/net/ipv4/conf/eth2/rp_filter = 1
/proc/sys/net/ipv4/conf/eth2/log_martians = 0
/proc/sys/net/ipv4/conf/lo/proxy_arp = 0
/proc/sys/net/ipv4/conf/lo/arp_filter = 0
/proc/sys/net/ipv4/conf/lo/arp_ignore = 0
/proc/sys/net/ipv4/conf/lo/rp_filter = 1
/proc/sys/net/ipv4/conf/lo/log_martians = 0
Routing Rules
0: from all lookup 255
32766: from all lookup main
32767: from all lookup default
Table 255:
local 10.3.0.2 dev eth0 proto kernel scope host src 10.3.0.2
broadcast 127.255.255.255 dev lo proto kernel scope link src 127.0.0.1
broadcast 10.3.0.0 dev eth0 proto kernel scope link src 10.3.0.2
broadcast 85.115.25.80 dev eth2 proto kernel scope link src 85.115.25.93
broadcast 85.115.25.95 dev eth2 proto kernel scope link src 85.115.25.93
local 85.115.25.93 dev eth2 proto kernel scope host src 85.115.25.93
broadcast 10.3.0.255 dev eth0 proto kernel scope link src 10.3.0.2
broadcast 127.0.0.0 dev lo proto kernel scope link src 127.0.0.1
local 127.0.0.1 dev lo proto kernel scope host src 127.0.0.1
local 127.0.0.0/8 dev lo proto kernel scope host src 127.0.0.1
Table default:
Table main:
83.97.6.169 via 85.115.25.81 dev eth2
194.145.239.250 via 85.115.25.81 dev eth2
83.97.7.192/28 dev eth2 scope link
85.115.25.80/28 dev eth2 proto kernel scope link src 85.115.25.93
10.113.2.0/27 dev eth2 scope link
10.3.0.0/24 dev eth0 proto kernel scope link src 10.3.0.2
default via 10.3.0.1 dev eth0
ARP
? (10.3.0.17) auf <unvollständig> auf eth0
? (10.113.2.23) auf <unvollständig> auf eth2
? (10.113.2.16) auf <unvollständig> auf eth2
? (10.3.0.1) auf FE:FF:FF:FF:FF:FF [ether] auf eth0
? (10.3.0.9) auf <unvollständig> auf eth0
? (85.115.25.81) auf 00:1F:9F:00:22:E2 [ether] auf eth2
? (10.113.2.24) auf <unvollständig> auf eth2
? (10.113.2.25) auf <unvollständig> auf eth2
? (83.97.7.196) auf <unvollständig> auf eth2
? (10.113.2.28) auf <unvollständig> auf eth2
? (10.113.2.15) auf <unvollständig> auf eth2
? (10.113.2.18) auf <unvollständig> auf eth2
Modules
ip_conntrack 49856 24
ipt_MASQUERADE,ip_nat_tftp,ip_nat_snmp_basic,ip_nat_sip,ip_nat_pptp,ip_nat_irc,ip_nat_h323,ip_nat_ftp,ip_nat_amanda,ip_conntrack_tftp,ip_conntrack_sip,ip_conntrack_pptp,ip_conntrack_netbios_ns,ip_conntrack_irc,ip_conntrack_h323,ip_conntrack_ftp,ip_conntrack_amanda,xt_helper,xt_conntrack,xt_CONNMARK,xt_connmark,xt_state,iptable_nat,ip_nat
ip_conntrack_amanda 5700 1 ip_nat_amanda
ip_conntrack_ftp 8528 1 ip_nat_ftp
ip_conntrack_h323 48444 1 ip_nat_h323
ip_conntrack_irc 7568 1 ip_nat_irc
ip_conntrack_netbios_ns 3808 0
ip_conntrack_pptp 12272 1 ip_nat_pptp
ip_conntrack_sip 8144 1 ip_nat_sip
ip_conntrack_tftp 5112 1 ip_nat_tftp
ip_nat 17740 12
ipt_SAME,ipt_REDIRECT,ipt_NETMAP,ipt_MASQUERADE,ip_nat_tftp,ip_nat_sip,ip_nat_pptp,ip_nat_irc,ip_nat_h323,ip_nat_ftp,ip_nat_amanda,iptable_nat
ip_nat_amanda 3168 0
ip_nat_ftp 4096 0
ip_nat_h323 7872 0
ip_nat_irc 3488 0
ip_nat_pptp 6756 0
ip_nat_sip 4864 0
ip_nat_snmp_basic 10148 0
ip_nat_tftp 2688 0
iptable_filter 3872 1
iptable_mangle 3648 1
iptable_nat 7812 0
iptable_raw 2912 0
ip_tables 13892 4
iptable_raw,iptable_nat,iptable_mangle,iptable_filter
ipt_addrtype 2720 4
ipt_ah 2784 0
ipt_CLUSTERIP 8964 0
ipt_dscp 2560 0
ipt_DSCP 3104 0
ipt_ecn 3072 0
ipt_ECN 3840 0
ipt_hashlimit 9512 0
ipt_iprange 2656 0
ipt_LOG 6880 8
ipt_MASQUERADE 4480 0
ipt_NETMAP 2944 0
ipt_owner 2848 0
ipt_recent 9200 0
ipt_REDIRECT 2944 0
ipt_REJECT 6016 4
ipt_SAME 3264 0
ipt_TCPMSS 4864 0
ipt_tos 2528 0
ipt_TOS 3072 0
ipt_ttl 2752 0
ipt_TTL 3168 0
ipt_ULOG 8548 0
xt_CLASSIFY 2752 0
xt_comment 2720 0
xt_connmark 2912 0
xt_CONNMARK 3232 0
xt_conntrack 3392 0
xt_dccp 4164 0
xt_helper 3328 0
xt_length 2816 0
xt_limit 3520 0
xt_mac 2784 0
xt_mark 2752 0
xt_MARK 3232 0
xt_multiport 4032 4
xt_NFQUEUE 2912 0
xt_physdev 3792 0
xt_pkttype 2784 0
xt_policy 4416 38
xt_state 3040 26
xt_tcpmss 3104 0
xt_tcpudp 3904 22
Shorewall has detected the following iptables/netfilter capabilities:
NAT: Available
Packet Mangling: Available
Multi-port Match: Available
Extended Multi-port Match: Available
Connection Tracking Match: Available
New Connection Tracking Match Syntax: Available
Packet Type Match: Available
Policy Match: Available
Physdev Match: Available
Physdev-is-bridged Support: Available
Packet length Match: Available
IP range Match: Available
Recent Match: Available
Owner Match: Available
Ipset Match: Not available
CONNMARK Target: Available
Extended CONNMARK Target: Available
Connmark Match: Available
Extended Connmark Match: Available
Raw Table: Available
IPP2P Match: Not available
CLASSIFY Target: Available
Extended REJECT: Available
Repeat match: Available
MARK Target: Available
Extended MARK Target: Available
Mangle FORWARD Chain: Available
Comments: Available
Address Type Match: Available
TCPMSS Match: Available
Hashlimit Match: Available
NFQUEUE Target: Available
Traffic Control
Device eth0:
qdisc pfifo_fast 0: bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
Sent 10137958 bytes 10657 pkt (dropped 0, overlimits 0 requeues 0)
rate 0bit 0pps backlog 0b 0p requeues 0
Device eth2:
qdisc pfifo_fast 0: bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
Sent 125622 bytes 1109 pkt (dropped 0, overlimits 0 requeues 0)
rate 0bit 0pps backlog 0b 0p requeues 0
TC Filters
Device eth0:
Device eth2:
------------------------------------------------------------------------------ Special Offer-- Download ArcSight Logger for FREE (a $49 USD value)! Finally, a world-class log management solution at an even better price-free! Download using promo code Free_Logger_4_Dev2Dev. Offer expires February 28th, so secure your free ArcSight Logger TODAY! http://p.sf.net/sfu/arcsight-sfd2d
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
