Jerry Vonau wrote: > You have read http://www.shorewall.net/FAQ.htm#faq57 right? You may want > use balance here, then track might work. If you don't want to use > balance I'd suggest using something like this in tcrules for each > service that is dnat'ed > > 256:P 192.168.0.211 0.0.0.0/0 tcp - 80 > > which reads: mark packets with mark 256 in prerouting from $ip going > anywhere with source port of 80 > > repeat with edits for each service... > > Do these dnat'ed public ip addresses need to be available though the > vpn? If not, then the route_rules entries that point the dnat'ed boxes > to the main table may go away.
I'm unclear why this isn't working correctly to start with. Unfortunately, I could find no DNATed connections active in the dump so I couldn't look at their packet marks. But there are several active connections from eth2 and they are marked correctly: Example: tcp 6 374597 ESTABLISHED src=201.2.226.149 dst=217.133.234.179 sport=2873 dport=25 packets=4 bytes=168 src=217.133.234.179 dst=201.2.226.149 sport=25 dport=2873 packets=1 bytes=48 [ASSURED] mark=256 secmark=0 use=1 And the routing rules look correct: 0: from all lookup local 1000: from all to 192.168.1.0/24 lookup main 1001: from all to 172.18.36.64/26 lookup main ... <extra rules deleted> 10000: from all fwmark 0x100 lookup TISCALI 10001: from all fwmark 0x200 lookup INFO1 10013: from all fwmark 0x400 lookup LAN_TRANSPARENT_PROXY 20000: from 217.133.234.177 lookup TISCALI 20256: from 192.168.50.1 lookup INFO1 26002: from all iif eth1 lookup INFO1 32766: from all lookup main 32767: from all lookup default Rule 10000 should send all packets marked with '256' to TISCALI which is eth2. And the marking rules also look correct. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
