Hi!
I'm having a problem that I can't get my head around.
We have a webserver that runs both http and https. I have no problems
connecting to it from external networks. But when I try to connect to it
locally via https I get the following kernel error:
IPv4: host 10.10.10.238/if3 ignores redirects for 10.10.10.90 to 10.10.10.90
Everything works just fine with http/port 80, same url/ip adress. And I
have the same rules for both port 80 and 443. This drives me nuts!
Shorewall version: 5.2.3.4
Kernel: 5.14.0
My rules:
#ACTION SOURCE DEST PROTO DEST SOURCE
ORIGINAL RATE USER/
# PORT PORT(S)
DEST LIMIT GROUP
#SSH
ACCEPT net fw tcp 22
#FTP
ACCEPT net fw tcp 21
ACCEPT net fw tcp 20
ACCEPT net fw tcp 49152:65534
#Web
ACCEPT net fw tcp 80
ACCEPT net fw tcp 443
#Mysql
ACCEPT net fw tcp 3306
ACCEPT net fw udp 3306
#Web(DNAT) net lan:10.10.10.90
DNAT net lan:10.10.10.90:80 tcp 80 -
DNAT net lan:10.10.10.90:443 tcp 443 -
DNAT net lan:10.10.10.90:3306 tcp 3306 -
DNAT net lan:10.10.10.55:7771 tcp 7771 -
DNAT net lan:10.10.10.55:7776 tcp 7776 -
#DNAT net lan:10.10.10.55:3306 tcp 3306 -
DNAT net lan:10.10.10.55:8081 tcp 8081 -
#Allow local web
DNAT lan lan:10.10.10.90 tcp 80 - 1.1.1.1
DNAT gw lan:10.10.10.90 tcp 80 - 1.1.1.1
#Mysql DNAT
DNAT lan lan:10.10.10.90 tcp 3306 - 1.1.1.1
DNAT gw lan:10.10.10.90 tcp 3306 - 1.1.1.1
#Web local SSL
DNAT lan lan:10.10.10.90 tcp 443 - 1.1.1.1
DNAT gw lan:10.10.10.90 tcp 443 - 1.1.1.1
# listen for VPN on net
ACCEPT net fw udp 1194
# allow connections to the firewall itself to start VPNs:
ACCEPT all fw ah
ACCEPT all fw esp
#ACCEPT all net ah
#ACCEPT all net esp
ACCEPT net all udp 500
ACCEPT all fw udp 4500
ACCEPT all all tcp 993
#for wireguard
ACCEPT net fw udp 41194
Ping(ACCEPT) gw lan
Ping(ACCEPT) gw gw
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
Any input would be greatly appreciated!
Thanks!
/Peter
--
Turbin – Creative production agency
Peter Andersson
Turbin AB, Klevgränd 2, 116 46 Stockholm
Tel +46 8 545 286 47 | Mob +46 70 226 09 21 | Web turbin.se
_______________________________________________
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users
