On Wed, Sep 30, 2009 at 11:29:23AM -0700, Tom Eastep wrote: > Justin T Pryzby wrote: > > Shorewall 4.4 is running on a gateway machine with 2 providers, and > > also running squid and pppd. I have two related problems. One is > > that I've never been able to get "balance,track" working for both > > interfaces, thus can't use "routefilter" for both. 2nd problem is web > > access from the shorewall machine itself.
> > masq looks like:
> > lo 0.0.0.0/0 127.0.0.1 tcp 3128
>
> What in the world is that for?
That's the ony way I've been able to get local HTTP access working.
Without it, squid denyies requests with PPP0 source address which is
not included in the ACL allow list (since it's dynamic).
I made changes to put our configuration the way it's supposed to work.
The shorewall dump is attached. I got the following:
Sep 30 12:08:39 charcoal kernel: [410035.138906] martian source 206.80.216.107
from 209.46.18.85, on dev ppp0
Sep 30 12:08:46 charcoal kernel: [410042.416678] martian source 206.80.216.107
from 64.4.32.7, on dev ppp0
Sep 30 12:08:52 charcoal kernel: [410048.016960] martian source 206.80.216.107
from 74.205.114.154, on dev ppp0
Sep 30 12:08:52 charcoal kernel: [410048.567794] martian source 206.80.216.107
from 63.245.221.10, on dev ppp0
Sep 30 12:08:55 charcoal kernel: [410050.617160] martian source 206.80.216.107
from 209.167.231.15, on dev ppp0
Sep 30 12:08:58 charcoal kernel: [410054.307034] martian source 206.80.216.107
from 174.129.210.177, on dev ppp0
The differences between the intended configuration and the kludgy
configuration are:
--- interfaces 2009-09-30 12:10:08.000000000 -0700
+++ ../cur/interfaces 2009-09-30 12:27:32.000000000 -0700
@@ -2 +2 @@
-net eth0 detect
routefilter,logmartians,tcpflags,nosmurfs,norfc1918,blacklist
+net eth0 detect
logmartians,tcpflags,nosmurfs,norfc1918,blacklist # routefilter,
--- masq 2009-09-30 12:30:09.000000000 -0700
+++ ../cur/masq 2009-09-30 12:27:32.000000000 -0700
@@ -3,0 +4 @@
+lo 0.0.0.0/0 127.0.0.1 tcp 3128
--- providers 2009-09-30 12:10:17.000000000 -0700
+++ ../cur/providers 2009-09-30 12:27:32.000000000 -0700
@@ -9,2 +9,2 @@
-dsl 2 0x200 - ppp0 -
track,balance -
-t1 1 0x100 - eth0 206.80.216.105
track,balance -
+dsl 2 0x200 main ppp0 -
track,balance eth1
+t1 1 0x100 main eth0 206.80.216.105 track
eth1
--- route_rules 2009-09-30 12:30:36.000000000 -0700
+++ ../cur/route_rules 2009-09-30 12:27:32.000000000 -0700
@@ -7,0 +8 @@
+- 10.1.0.0/24 main 1000
--- shorewall.conf 2009-09-30 12:14:41.000000000 -0700
+++ ../cur/shorewall.conf 2009-09-30 12:27:32.000000000 -0700
@@ -184 +184 @@
-USE_DEFAULT_RT=Yes
+USE_DEFAULT_RT=No
Justin
shorewall-dump.txt.bz2
Description: Binary data
------------------------------------------------------------------------------ Come build with us! The BlackBerry® Developer Conference in SF, CA is the only developer event you need to attend this year. Jumpstart your developing skills, take BlackBerry mobile applications to market and stay ahead of the curve. Join us from November 9-12, 2009. Register now! http://p.sf.net/sfu/devconf
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
