On Thu, Aug 18, 2011 at 11:59, Robert Kawecki <[email protected]> wrote:
> Dnia 2011-08-18, czw o godzinie 10:11 +0200, Wojtek Swiatek pisze: >> I am trying to exactly replicate the two interface setup >> (http://www.shorewall.net/two-interface.htm). (...) >> I cannot manage to have traffic going from loc to net. > As per the default policy, allowed packets will not generate any logs. > So the packets are either not reaching your gateway at all, or they are > passing through and the failure is related to SNAT somehow. I tried to log them with a loc net ACCEPT info in /etc/shorewall/policy. I guess that if they were going through they would have been logged? > Have you checked > with tcpdump that your clients' packets ever appear on the LAN side? (-i > eth0). I connect via ssh from a client on the LAN to the server so packets get to the server LAN interface (eth0 in my case). I will check with tcpdump for packets intended to net. > The connection table indicates that local clients are > communicating within the local network, so maybe the missing link is the > default gateway setting (a route to 0.0.0.0/0) on the clients? There is a default route on the clients which points to the IP assigned to eth0 (the interface for loc) > When you have verified that they do indeed appear on eth0, check if they > are visible on eth1 too, i.e. if they get forwarded. A tcpdump run on > eth1 should also uncover any possible NAT problems. I will run a tcpdump on the eth1 interface (I expect not to see them there, ie. to have a problem with ip forwarding) Thanks for the message, Wojtek ------------------------------------------------------------------------------ Get a FREE DOWNLOAD! and learn more about uberSVN rich system, user administration capabilities and model configuration. Take the hassle out of deploying and managing Subversion and the tools developers use with it. http://p.sf.net/sfu/wandisco-d2d-2 _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
