I'm trying to figure out how to add selective routing of HTTP traffic over an
openvpn tunnel.
Before I post a dump to the mailing list I wanted to get confirmation that the
configuration I'm trying is the correct one, and if it isn't, what specifically
is needed to achieve the objective.
The gateway router and firewall ("Jeeves") OS is Ubuntu 12.04 Precise (with
Shorewall 4.4.26.1) connected to the Internet using a PPP connection over VDSL
(ppp0). The ppp0 interface connects via a
bridged external VDSL modem which is connected to a 100Mbps ethernet interface
(vdsl). An openvpn tunnel (tun0) connects to a data-centre dedicated server
("Pella") which is configured for
masquerading. The local area network is connected using a bridge (br0) that
combines eight ethernet ports (5 x 1000Mbps, 3 x 100Mbps) and a hostapd managed
wireless lan (wlan0). There is a second
link (eth9) to a management ethernet interface on the VDSL modem.
v---------mgmt--> eth9------¬
Internet <--> ISP <--PPP--> VDSL modem <--PPP--> vdsl--Jeeves--br0
[eth1:8,wlan0] <-- LAN 10.254.251.0/24 -->
^ |
| |
eth0--pella--tun0 <-- 10.254.252.17 -- 10.254.252.18 --> tun0
I applied a fix mentioned for Ubuntu:
$ sed -i '1,1 s,/bin/sh,/bin/bash,' /sbin/shorewall
Squid3 on the firewall (Jeeves) is used in transparent proxy mode using
Shorewall rules to redirect requests for TCP port 80 to port 3128.
dnsmasq on Jeeves is configured to use upstream DNS servers via tun0.
/etc/shorewall/rules
# Redirect HTTP port 80 requests to the transparent squid proxy running on the
firewall
REDIRECT loc 3128 tcp www -
!10.0.0.0/8,192.168.1.0/24
For a time the default route on Jeeves was via tun0 so all traffic went via
Pella. That all worked fine.
Later it became desirable to route HTTPS and other traffic directly to the ISP
on ppp0 (better latency) so the default route became ppp0. DNS traffic is still
routed via tun0 (a combination of the
dnsmasq DNS server entries, and openvpn's client routes for specific DNS hosts).
HTTP traffic from the LAN is being proxied by squid3 and using the ppp0
interface. I'd like to have just this HTTP traffic routed over tun0.
I couldn't find any specific documentation on this scenario but the suggestion
seems to be to combine packet marking with an alternate route. Therefore I
started off with:
/etc/shorewall/tcrules
# MARK SOURCE DEST PROTO DEST_PORTS SOURCE_PORTS USER TEST LENGTH TOS
80 $FW - tcp 80 - - - - -
I confirmed via 'shorewall iptrace -p tcp --dport 80' that the mark is being
applied to the packets. Then I added a provider:
/etc/shorewall/providers
# NAME NUMBER MARK DUPLICATE INTERFACE GATEWAY OPTIONS COPY
VPN 1 80 main tun0 detect track,loose br0
I have tried various permutations of OPTIONS and COPY - these are the most
recent iteration.
This configuration fails to work correctly. Specifically, using tcpdump on both
ends of tun0 (Jeeves and Pella) and watching the iptrace output I can see that
packets are being intercepted by
squid3, proxied out via tun0, replies come back in on tun0 but do not reach the
original client. I can't be sure if they reach squid3 or not. Trying a manual
connection from Jeeves seems to indicate
the response packets aren't making it to the client process, e.g.:
$ wget -O - http://gb.archive.ubuntu.com/ubuntu/
tries to connect to each of the round-robin IPs associated with the hostname
but eventually fails even though the tcpdump and iptrace logging shows
responses returning via tun0 to Jeeves.
This affects LAN clients *and* direct connections from Jeeves whether or not
the Squid transparent proxy is active, which leads me to believe I'm missing
something in the Shorewall configuration.
Based on an analysis of the logs I thought maybe SNAT or MASQ was required for
the traffic being routed via tun0 so I tried two variations but neither seems
to solve the issue:
/etc/shorewall/masq
#INTERFACE SOURCE ADDRESS PROTO PORT(S) IPSEC
MARK
ppp0 10.0.0.0/8,169.254.0.0/16,172.16.0.0/12,192.168.0.0/16 82.71.24.87
eth9 br0
#tun0 10.0.0.0/8,127.0.0.0/8 10.254.252.18
#tun0 br0
------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
