I made these changes to shorewall and rebooted. The result was all hosts
lost Internet access.
/ETC/shorewall/hosts
#ZONE HOST(S) OPTIONS
loc eth1:192.168.1.0/24
loc eth1:192.168.2.0/24
loc eth1:192.168.140.0/24
loc eth1:192.168.142.0/24
loc eth1:192.168.143.0/24
loc eth1:192.168.145.0/24
loc eth1:192.168.146.0/24
loc eth1:192.168.147.0/24
loc eth1:192.168.148.0/24
And then this:
/ETC/shorewall/Interfaces
#ZONE INTERFACE BROADCAST OPTIONS
net eth0 142.165.207.162
routefilter,norfc1918,tcpflags
loc eth1
192.168.1.255,192.168.2.255,192.168.140.255,192.168.142.255,192.168.143.255,
192.168.145.255,192.168.146.255,192.168.147.255,192.168.148.255
vpn ipsec0
I watched shorewall load and it did show all of these networks as defining
the "loc" zone as I would expect. I am just not sure why we lost Internet
access after that point. Do I need to define these subnets as for example
"192.168.1.0/24,192.168.2.0/24...)
I think I may not have given all the information in my previous post. Here
are the relevant configs. (Some IPs have been altered to protect the
innocent)
IP ROUTE:
192.168.147.0/24 dev eth1 proto kernel scope link src 192.168.147.4
192.168.146.0/24 via 192.168.147.2 dev eth1
192.168.145.0/24 via 192.168.147.2 dev eth1
192.168.2.0/24 via 192.168.147.5 dev eth1
192.168.1.0/24 via 192.168.147.5 dev eth1
192.168.148.0/24 via 192.168.147.2 dev eth1
10.10.26.0/24 via 142.165.207.254 dev ipsec0
192.168.143.0/24 via 192.168.147.1 dev eth1
192.168.142.0/24 via 192.168.147.1 dev eth1
142.165.207.0/24 dev eth0 proto kernel scope link src 142.165.207.*
142.165.207.0/24 dev ipsec0 proto kernel scope link src 142.165.207.*
192.168.140.0/24 via 192.168.147.3 dev eth1
default via 142.165.207.254 dev eth0
IP ADDR:
3: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
link/ether 00:01:02:78:13:4d brd ff:ff:ff:ff:ff:ff
inet 142.165.207.162/24 brd 142.165.207.255 scope global eth0
4: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
link/ether 00:04:75:90:02:b2 brd ff:ff:ff:ff:ff:ff
inet 192.168.147.4/24 brd 192.168.147.255 scope global eth1
9: ipsec0: <NOARP,UP> mtu 16260 qdisc pfifo_fast qlen 10
link/ether 00:01:02:78:13:4d brd ff:ff:ff:ff:ff:ff
inet 142.165.207.162/24 brd 142.165.207.255 scope global ipsec0
/ETC/INTERFACES
auto eth0
iface eth0 inet static
address 142.165.207.*
netmask 255.255.255.0
broadcast 142.165.207.255
gateway 142.165.207.254
# Step 2: configure internal interface
# Default: eth1 / fixed IP = 192.168.1.254
auto eth1
iface eth1 inet static
address 192.168.147.4
netmask 255.255.255.0
broadcast 192.168.147.255
up ip route add 192.168.140.0/24 via 192.168.147.3 || true
up ip route add 192.168.142.0/24 via 192.168.147.1 || true
up ip route add 192.168.143.0/24 via 192.168.147.1 || true
up ip route add 192.168.1.0/24 via 192.168.147.5 || true
up ip route add 192.168.2.0/24 via 192.168.147.5 || true
up ip route add 192.168.145.0/24 via 192.168.147.2 || true
up ip route add 192.168.146.0/24 via 192.168.147.2 || true
up ip route add 192.168.148.0/24 via 192.168.147.2 || true
/etc/shorewall/masq
#INTERFACE SUBNET ADDRESS
eth0 192.168.1.0/24
eth0 192.168.2.0/24
eth0 192.168.140.0/24
eth0 192.168.142.0/24
eth0 192.168.143.0/24
eth0 192.168.145.0/24
eth0 192.168.146.0/24
eth0 192.168.147.0/24
eth0 192.168.148.0/24
Thanks in advance!
Troy
-----Original Message-----
From: Tom Eastep [mailto:[EMAIL PROTECTED]
Sent: Monday, December 08, 2003 11:58 AM
To: Troy Aden
Cc: Leaf-User (E-mail)
Subject: Re: [leaf-user] Shorewall questions
On Mon, 2003-12-08 at 09:36, Troy Aden wrote:
> I have a quick newbie shorewall question.
> In setup I have several static routes from several internal routers going
to
> the shorewall box.
>
> The external interface (eth0) has the external IP. But the internal
> interface has to be able to recognize 8 separate subnets as internal IPs
and
> treat them as the local zone.
> I suspect that I would have to make changes to the shorewall/interfaces
file
> and add all of these subnets to the eth1 interface. Can anyone confirm
this
> for me? Also I have reviewed the docs and I can't seem to find an example
of
> the appropriate syntax to make entries like this in the
shorewall/interfaces
> file.
>
You might take a look at:
http://www.shorewall.net/Multiple_Zones.html
Be sure to pay attention to the links in the first numbered list.
-Tom
--
Tom Eastep \ Nothing is foolproof to a sufficiently talented fool
Shoreline, \ http://shorewall.net
Washington USA \ [EMAIL PROTECTED]
-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
Free Linux Tutorials. Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
------------------------------------------------------------------------
leaf-user mailing list: [EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/leaf-user
SR FAQ: http://leaf-project.org/pub/doc/docmanager/docid_1891.html
