On Fri, 2009-06-12 at 08:36 -0700, Mike Lander wrote: > > > > > Mike Lander wrote: > > > > > not sure how to config shorewall or if I have this bridge right but > > > now there seems to be several ways to config shorewall here > > > which shorewall docs should I look at with suse 11.1 and shorewall 4.2.9? > > > > Hi Mike, > > > > 'brctl show br0' will show you the bridge configuration. > Tom > > linux-rwu0:~ # brctl show br0 > bridge name bridge id STP enabled interfaces > br0 8000.0016177efed1 no eth1 > tap0 > > > > > Do you need to firewall traffic through the bridge? If not, simply set > > 'routeback' on 'br0' and you are finished. That's > > http://www.shorewall.net/SimpleBridge.html. If you need to firewall > > traffic through the bridge, then you need to folllow > > http://www.shorewall.net/bridge-Shorewall-perl.html. > > I do need to firewall traffic to the internet eth0, however traffic > between the bridge I just need traffic shaping. I remove the push > route and bridge option. > > Items I changed in shorewall from stock two interface is in interfaces,masq, > and routestopped > which is correct according to simple bridge I believe. I changed these as > follows > > net eth0 detect tcpflags,nosmurfs > loc br0 detect routeback > > masq > eth0 br0 > > routestopped > br0 - > > However when starting the bridge with /etc/init.d/bridge, I lose connectivity > with > the internet from the firewall and lan. I believe routing in the > /etc/init.d/bridge > is incorrect. I followed examples and I believe the gateway is incorrect. > Here is /etc/init.d/bridge, ip route ls and ifconfig. > > #!/bin/bash > > ########openvpn bridge-script################# > # Set up Ethernet bridge on Linux > # Requires: bridge-utils > ################################# > > # Define Bridge Interface > br="br0" > > # Define list of TAP interfaces to be bridged > tap="tap0" > > # Define a list of physical ethernet interfaces to be bridged > # with TAP interface(s) above. > # > eth="eth1" > eth_ip="10.194.79.191" > eth_netmask="255.255.255.0" > eth_broadcast="10.194.79.255" > default_gw=10.194.79.191 > Don't add default_gw here, the firewall would be the gateway for that lan.
> # Path to the system networking script > # For Debian > #NETWORK="/etc/init.d/networking" > # For SuSE > NETWORK="/etc/init.d/network" > > # Path to the openvpn start/stop script > OPENVPN_INIT="/etc/init.d/openvpn" > > # Path to the openvpn binary > OPENVPN="/usr/sbin/openvpn" > > # Path to the brctl binary > BRCTL="/sbin/brctl" > > # Path to the ifconfig binary > IFCONFIG="/sbin/ifconfig" > > # Path to the route binary > ROUTE="/sbin/route" > > do_start(){ > > for i in $tap; do > $OPENVPN --mktun --dev $i > done > > $BRCTL addbr $br > > for i in $eth; do > $BRCTL addif $br $i > done > > for i in $tap; do > $BRCTL addif $br $i > done > > for i in $eth; do > $IFCONFIG $i 0.0.0.0 promisc up > done > > for i in $tap; do > $IFCONFIG $i 0.0.0.0 promisc up > done > > $IFCONFIG $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast > > $ROUTE add default gw $default_gw > > $OPENVPN_INIT start > > } > > do_stop(){ > > $IFCONFIG $br down > $BRCTL delbr $br > > for i in $tap; do > $OPENVPN --rmtun --dev $i > $IFCONFIG $i down > $NETWORK force-reload > done > > $OPENVPN_INIT stop > > } > > case "$1" in > > start) > do_start > ;; > stop) > do_stop > ;; > restart) > do_stop > sleep 1 > do_start > ;; > *) > echo "usage: $0 start|stop|restart" >&2 > exit 3 > ;; > esac > exit 0 > > linux-rwu0:~ # ip route ls > 75.149.172.80/28 dev eth0 proto kernel scope link src 75.149.172.88 > 10.194.79.0/24 dev br0 proto kernel scope link src 10.194.79.191 > 169.254.0.0/16 dev eth0 scope link > 127.0.0.0/8 dev lo scope link > default via 10.194.79.191 dev br0 scope link > default via 75.149.172.94 dev eth0 > > The gateway to br0 is the problem I think. Since the firewall already has > a gateway do enter 75.149.172.94 as the gateway in /etc/init.d/bridge? > No don't add anything to the bridge script as a gateway. > ifconfig > > linux-rwu0:~ # ifconfig > br0 Link encap:Ethernet HWaddr 00:16:17:7E:FE:D1 > inet addr:10.194.79.191 Bcast:10.194.79.255 Mask:255.255.255.0 > inet6 addr: fe80::216:17ff:fe7e:fed1/64 Scope:Link > UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 > RX packets:1742 errors:0 dropped:0 overruns:0 frame:0 > TX packets:881 errors:0 dropped:0 overruns:0 carrier:0 > collisions:0 txqueuelen:0 > RX bytes:145423 (142.0 Kb) TX bytes:257627 (251.5 Kb) > > eth0 Link encap:Ethernet HWaddr 00:14:D1:13:43:11 > inet addr:75.149.172.88 Bcast:75.149.172.95 Mask:255.255.255.240 > inet6 addr: fe80::214:d1ff:fe13:4311/64 Scope:Link > UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 > RX packets:739 errors:0 dropped:0 overruns:0 frame:0 > TX packets:309 errors:0 dropped:0 overruns:0 carrier:0 > collisions:0 txqueuelen:1000 > RX bytes:69916 (68.2 Kb) TX bytes:36146 (35.2 Kb) > Interrupt:20 Base address:0x4000 > > eth1 Link encap:Ethernet HWaddr 00:16:17:7E:FE:D1 > inet6 addr: fe80::216:17ff:fe7e:fed1/64 Scope:Link > UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 > RX packets:2987 errors:0 dropped:0 overruns:0 frame:0 > TX packets:1538 errors:0 dropped:0 overruns:0 carrier:0 > collisions:0 txqueuelen:1000 > RX bytes:317952 (310.5 Kb) TX bytes:528815 (516.4 Kb) > Interrupt:23 Base address:0xc000 > > lo Link encap:Local Loopback > inet addr:127.0.0.1 Mask:255.0.0.0 > inet6 addr: ::1/128 Scope:Host > UP LOOPBACK RUNNING MTU:16436 Metric:1 > RX packets:25 errors:0 dropped:0 overruns:0 frame:0 > TX packets:25 errors:0 dropped:0 overruns:0 carrier:0 > collisions:0 txqueuelen:0 > RX bytes:2788 (2.7 Kb) TX bytes:2788 (2.7 Kb) > > tap0 Link encap:Ethernet HWaddr 8E:F2:06:E9:82:70 > inet6 addr: fe80::8cf2:6ff:fee9:8270/64 Scope:Link > UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 > RX packets:0 errors:0 dropped:0 overruns:0 frame:0 > TX packets:1067 errors:0 dropped:0 overruns:0 carrier:0 > collisions:0 txqueuelen:100 > RX bytes:0 (0.0 b) TX bytes:85438 (83.4 Kb) > > > Mike > Jerry ------------------------------------------------------------------------------ Crystal Reports - New Free Runtime and 30 Day Trial Check out the new simplified licensing option that enables unlimited royalty-free distribution of the report engine for externally facing server and web deployment. http://p.sf.net/sfu/businessobjects _______________________________________________ Shorewall-users mailing list Shorewall-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/shorewall-users