As often happens, posing a problem to someone else gave me hints to solve the problem myself. In the end, my problem was only in filtering, so I do need ACCEPT loc:$local_dnatted_ip net1 in rules, but I do not need eth2 $local_dnatted_ip in masq, and I do not need $local_dnatted_ip - main 1100 in route_rules, since "track" option works as excpected.
On Wed, Aug 19, 2009 at 11:35:21AM -0700, Tom Eastep wrote: > Jerry Vonau wrote: > > > You have read http://www.shorewall.net/FAQ.htm#faq57 right? You may want > > use balance here, then track might work. If you don't want to use > > balance I'd suggest using something like this in tcrules for each > > service that is dnat'ed > > > > 256:P 192.168.0.211 0.0.0.0/0 tcp - 80 > > > > which reads: mark packets with mark 256 in prerouting from $ip going > > anywhere with source port of 80 > > > > repeat with edits for each service... > > > > Do these dnat'ed public ip addresses need to be available though the > > vpn? If not, then the route_rules entries that point the dnat'ed boxes > > to the main table may go away. > > I'm unclear why this isn't working correctly to start with. > Unfortunately, I could find no DNATed connections active in the dump so > I couldn't look at their packet marks. But there are several active > connections from eth2 and they are marked correctly: > > Example: > > tcp 6 374597 ESTABLISHED src=201.2.226.149 dst=217.133.234.179 > sport=2873 dport=25 packets=4 bytes=168 src=217.133.234.179 > dst=201.2.226.149 sport=25 dport=2873 packets=1 bytes=48 [ASSURED] > mark=256 secmark=0 use=1 > > And the routing rules look correct: > > 0: from all lookup local > 1000: from all to 192.168.1.0/24 lookup main > 1001: from all to 172.18.36.64/26 lookup main > ... <extra rules deleted> > 10000: from all fwmark 0x100 lookup TISCALI > 10001: from all fwmark 0x200 lookup INFO1 > 10013: from all fwmark 0x400 lookup LAN_TRANSPARENT_PROXY > 20000: from 217.133.234.177 lookup TISCALI > 20256: from 192.168.50.1 lookup INFO1 > 26002: from all iif eth1 lookup INFO1 > 32766: from all lookup main > 32767: from all lookup default > > Rule 10000 should send all packets marked with '256' to TISCALI which is > eth2. > > And the marking rules also look correct. > > -Tom > -- > Tom Eastep \ When I die, I want to go like my Grandfather who > Shoreline, \ died peacefully in his sleep. Not screaming like > Washington, USA \ all of the passengers in his car > http://shorewall.net \________________________________________________ > > ------------------------------------------------------------------------------ > Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day > trial. Simplify your report design, integration and deployment - and focus on > what you do best, core application coding. Discover what's new with > Crystal Reports now. http://p.sf.net/sfu/bobj-july > _______________________________________________ > Shorewall-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/shorewall-users ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
