On 17/03/13 18:33, Tom Eastep wrote: >> /etc/shorewall/masq >> #INTERFACE SOURCE ADDRESS PROTO PORT(S) IPSEC >> MARK >> ppp0 10.0.0.0/8,169.254.0.0/16,172.16.0.0/12,192.168.0.0/16 82.71.24.87 >> #ppp1 10.0.0.0/8,169.254.0.0/16,172.16.0.0/12,192.168.0.0/16 >> 82.71.24.87 >> eth9 br0 >> tun0 10.0.0.0/8,127.0.0.0/8 10.254.252.18 >> #tun0 br0 >> > > That masq entry certainly won't change the SOURCE ip from 82.71.24.87 to > 10.254.252.18. It only works for 10.0.0.0/8 in the SOURCE (you can't NAT > 127.0.0.0/8 so that part of the rule is just extra noise).
Of course! I think I added 127.0.0.0/8 in desperation when testing connections from local processes on Jeeves. The problem seems to be something to do with packet marking - I tried it manually for a client on the LAN and it works fine: $ ip route add default via 10.254.252.17 dev tun0 table VPN $ ip rule add from 10.254.251.50 lookup VPN prio 10001 $ echo 0 > /proc/sys/net/ipv4/conf/tun0/rp_filter But if I try marking HTTP packers it fails when using: $ ip rule del from 10.254.251.50 lookup VPN prio 10001 $ ip rule add fwmark 0x50/0xffffffff lookup VPN $ iptables -t mangle -A tcfor -p tcp --dport 80 -j MARK --set-xmark 0x50/0xffffffff Which - apart from using table 'tcfor' instead of 'tcout' - is the same as the Shorewall rule. The Shorewall rule remains, too: $ sudo iptables -t mangle -S [sudo] password for tj: -P PREROUTING ACCEPT -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -P POSTROUTING ACCEPT -N tcfor -N tcin -N tcout -N tcpost -N tcpre -A PREROUTING -j tcpre -A INPUT -j tcin -A FORWARD -j MARK --set-xmark 0x0/0xff -A FORWARD -j tcfor -A OUTPUT -j tcout -A POSTROUTING -j tcpost -A tcfor -p tcp -m tcp --dport 80 -j MARK --set-xmark 0x50/0xffffffff -A tcout -p tcp -m tcp --dport 80 -j MARK --set-xmark 0x50/0xffffffff ------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_d2d_mar _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
