Machine in question is Debian 5 running 2.6.26-2-amd64.
Shorewall version is 4.0.15
IPSec Tools version is 1:0.7.1-1.3+lenny2
Racoon version is 1:0.7.1-1.3+lenny2
This system is making an IPSec connection with a Watchguard firewall. If I
set a Shorewall policy of "all all ACCEPT" I can pass traffic in both
directions through the tunnel. However, with my current configuration I am
able to get traffic to pass from the Watchguard side, but any traffic I try
to pass through it ends up Host Unreachable with this line in the Shorewall
log...
May 11 03:08:40 iqonline-gw kernel: [63836226.948493]
Shorewall:FORWARD:REJECT:IN=eth0.10 OUT=eth1 SRC=10.128.3.3
DST=192.168.4.99 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=ICMP TYPE=8
CODE=0 ID=20461 SEQ=1834 MARK=0x5
I'm running OpenVPN on the vpn zone, and IPSEC on the sec zone.
My subnet here: 10.128.0.0/9
Watchguard subnet: 192.168.0.0/21
v10 is basically my internal and ext all all my external vlans.
HOSTS:
sec eth1:10.128.0.0/9
vpn eth1:10.128.0.0/9
INTERFACES:
net eth1 detect routefilter,norfc1918,blacklist
v10 eth0.10 detect routeback
ext eth0.76 detect routeback
ext eth0.230 detect
ext eth0.231 detect
ext eth0.232 detect
vpn tun+
MASQ:
eth1 eth0.10
POLICY:
fw all ACCEPT
v10 all ACCEPT
ext all ACCEPT
sec all ACCEPT
vpn all ACCEPT
net all DROP 6
all all REJECT 6
RULES:
ACCEPT net:192.168.0.0/21 all
TUNNELS:
openvpnserver:1194 net 0.0.0.0/0
ipsec net 0.0.0.0/0
ZONES:
fw firewall
sec ipsec # I've tried ipv4 here and ipsec in HOSTS
v10 ipv4
net ipv4
ext ipv4
vpn ipv4
Any help would be greatly appreciated, as I've been beating on this for
days and Googled myself to insanity. I've stripped my config down to the
bare minimum to eliminate errors but I just can't get her to budge. Thank
you!!!
-Mike Walker
------------------------------------------------------------------------------
One dashboard for servers and applications across Physical-Virtual-Cloud
Widest out-of-the-box monitoring support with 50+ applications
Performance metrics, stats and reports that give you Actionable Insights
Deep dive visibility with transaction tracing using APM Insight.
http://ad.doubleclick.net/ddm/clk/290420510;117567292;y
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
