Mike Lander wrote: >> Mike Lander wrote: >>>> I have a two Isp's setup that send mail to another two Isp firewall. >>>> For Ilustration I will call the firewall with the mail server in its dmz >>>> using proxy arp, >>>> (Firewall A). I will call the dependant firewall which sends mail to >>>> Firewall A, (Firewall B.) >>>> These two Firewall's have a openvpn tunnel between them. Firewall B is >>>> loc:10.5.198.0/24. >>>> What I would like to do is route any port 25 traffic from Firewall B >>>> through openvpn, >>>> to Firewall A's mail server in its Dmz. >>>> I am thinking that Firewall A will know to reply to 10.5.198.0/24 >>>> (Firewall B) >>>> because of the entry in Firewall A's route rules entry below. >>>> - 10.5.198.0/24 main 1000 >>>> >>>> If this where possible with the below statement may make things clear, >>>> what I want to do. As a reminder the mail server is in Firewall A Dmz. >>>> >>>> In tcrules with eth1 local on Firewall B >>>> >>>> tun4 eth1:<local subnet> <mail servers FQIP> tcp 25 >>>> I know the above wont work, What Will? >>>> >>>> >>>> Thanks >>>> Mike >>>> >>> I just thought of this instead of mangle tables maybe just add this route? >>> route add <65.42.53.203 mail server> 255.255.255.255 gw 172.16.1.2 (ip of >>> firewall B tun) >>> Just thought someone on this list may have done this through shorewall. >> You want to establish that route in the OpenVPN configuration using the >> 'route' directive. Shorewall can't do anything for you since the OpenVPN >> tunnel isn't one of the provider interfaces. >> > > > Fixed with route add -net <FQIP Mail Host IP> 255.255.255.255 gw $5 > in my vpn.conf > > However had to adjust my <vpn> to <dmz> polices before it would work.
You really need to modify your OpenVPN configuration to add the route. If the link goes down and then comes back up, the route will be gone unless you make OpenVPN configure it. > > Is it good practice to add vpn in providers? Usually not. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Come build with us! The BlackBerry(R) Developer Conference in SF, CA is the only developer event you need to attend this year. Jumpstart your developing skills, take BlackBerry mobile applications to market and stay ahead of the curve. Join us from November 9 - 12, 2009. Register now! http://p.sf.net/sfu/devconference
_______________________________________________ Shorewall-users mailing list Shorewall-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/shorewall-users
