-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Justin T Pryzby wrote:
> On Wed, Sep 30, 2009 at 11:29:23AM -0700, Tom Eastep wrote:
>> Justin T Pryzby wrote:
>>> Shorewall 4.4 is running on a gateway machine with 2 providers, and
>>> also running squid and pppd. I have two related problems. One is
>>> that I've never been able to get "balance,track" working for both
>>> interfaces, thus can't use "routefilter" for both. 2nd problem is web
>>> access from the shorewall machine itself.
>
>>> masq looks like:
>>> lo 0.0.0.0/0 127.0.0.1 tcp 3128
>> What in the world is that for?
> That's the ony way I've been able to get local HTTP access working.
> Without it, squid denyies requests with PPP0 source address which is
> not included in the ACL allow list (since it's dynamic).
So it isn't that you can't make local web access work -- you rather
can't make it work with Squid because of your use of ACLs.
Why are you using Squid for web access from the firewall itself? Surely,
the only web access that occurs from the firewall is for package updates
which likely won't benefit from the local caching Squid provides.
>
> I made changes to put our configuration the way it's supposed to work.
> The shorewall dump is attached. I got the following:
> Sep 30 12:08:39 charcoal kernel: [410035.138906] martian source
> 206.80.216.107 from 209.46.18.85, on dev ppp0
> Sep 30 12:08:46 charcoal kernel: [410042.416678] martian source
> 206.80.216.107 from 64.4.32.7, on dev ppp0
> Sep 30 12:08:52 charcoal kernel: [410048.016960] martian source
> 206.80.216.107 from 74.205.114.154, on dev ppp0
> Sep 30 12:08:52 charcoal kernel: [410048.567794] martian source
> 206.80.216.107 from 63.245.221.10, on dev ppp0
> Sep 30 12:08:55 charcoal kernel: [410050.617160] martian source
> 206.80.216.107 from 209.167.231.15, on dev ppp0
> Sep 30 12:08:58 charcoal kernel: [410054.307034] martian source
> 206.80.216.107 from 174.129.210.177, on dev ppp0
>
Route filtering seems to be broken with this configuration -- the
default route that Shorewall is creating is correct.
default
nexthop dev ppp0 weight 1
nexthop via 206.80.216.105 dev eth0 weight 1
I suggest that you leave leave 'balance' on that provider but turn off
route filtering on ppp0 (in /etc/shorewall/interfaces, include
"routefilter=0").
- -Tom
- --
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkrDvb8ACgkQO/MAbZfjDLKhQgCghYUXYxwZ0h10Hj6dLjBlbYRh
PkAAnjciYWQAYf56eDYwHTGjnvt5VMHv
=DZmT
-----END PGP SIGNATURE-----
------------------------------------------------------------------------------
Come build with us! The BlackBerry® Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9-12, 2009. Register now!
http://p.sf.net/sfu/devconf
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
