Wouter Amsterdam wrote:
I finally got my IPSec tunnel from my Fedora firewall system (running Shorewall 4.0.6) to a remote Draytek Router up-and-running, but I'm having difficulties directing traffic through the tunnel. From the output of "racoon –F –f racoon.conf"and the connection status page of the Draytek I can tell the tunnel is UP, but ping and traceroute requests to several hosts from and to both directions fail and also tcpdump reveals no traffic going through. Maybe that's because of my limited knowledge of tcpdump or because of some missing routing entries (or both), but I sure could use someone helping me in the right direction.SHOREWALL SHOW output is attached; IP ADRR SHOW and IP ROUTE SHOW output are:
In the future, please include the output of 'shorewall dump' rather than 'shorewall show' (see http://www.shorewall.net/support.htm#Guidelines). The former only shows the contents of the filter table while the latter gives us a complete look at your configuration, including routing and IPSEC.
In this instance, however, I think I can get you one step closer with the material you included. Using a 2.6 kernel with Racoon, there is no ipsec0 interface. So your vpn1 zone should be defined in terms of the eth0 interface rather than ipsec0. Another thing to keep in mind -- the traffic that goes through the tunnel is determined entirely by the IPSEC Security Associations that have been established; routing doesn't enter into it in any way.
-Tom -- Tom Eastep \ Nothing is foolproof to a sufficiently talented fool Shoreline, \ http://shorewall.net Washington USA \ [EMAIL PROTECTED] PGP Public Key \ https://lists.shorewall.net/teastep.pgp.key
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------- Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW! Studies have shown that voting for your favorite open source project, along with a healthy diet, reduces your potential for chronic lameness and boredom. Vote Now at http://www.sourceforge.net/community/cca08
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
