Eth0 --> LAN, IP: 10.10.80.12/24
Eth1 --> NET, ADSL 6M/640kb. The ISP is named Isp_6M in
providers file. IP: 10.10.90.12/24
Eth2 --> NET, DSL 1M/1M. The ISP is named Isp_1M in providers
file. IP: 10.10.100.12/24
Eth3 --> DMZ, IP: 10.10.110.12/24Nowadays, in the LAN I am load balancing the 2 ISP´s traffic out between ISP_1M and ISP_6M, prioritising the second one (isp_6M). In the case of DMZ I force outgoing traffic through Eth2.
I've an openvpn server running on the firewall and working on eth1 and I´d like to config my firewall to let a pptp client, running on my LAN (with IP 10.10.80.10), connect to a pptp remote vpn server of a different company. But I am not able to do this, an that´s my problem :)
The most important shorewall file config is like follows: /etc/shorewall/interfaces: #ZONE INTERFACE BROADCAST OPTIONS loc $LAN_IF detect dhcp,routebacknet $ADSL_IF detect tcpflags,blacklist,nosmurfs,routefilter,logmartians net $DSL_IF detect tcpflags,blacklist,nosmurfs,routefilter,logmartians
dmz $DMZ_IF detect vpn tun0 detect /etc/shorewall/policy: #SOURCE DEST POLICY LOG LIMIT:BURST # LEVEL loc net DROP info fw loc DROP info fw net DROP info fw dmz DROP info loc dmz DROP info ##OpenVPN ------ ## vpn fw ACCEPT info fw vpn ACCEPT info net vpn DROP info loc vpn ACCEPT info vpn loc ACCEPT info vpn net DROP info vpn dmz DROP info ##DMZ ---------- ## dmz net DROP info dmz fw DROP info dmz loc DROP info dmz vpn DROP info dmz all DROP info ## ------------- net all DROP info all all REJECT info /etc/shorewall/params: LAN_IF=eth0 ADSL_IF=eth1 DSL_IF=eth2 DMZ_IF=eth3 IP_GALILEO=10.10.80.10 --> it´s the pptp client. /etc/shorewall/masq:#INTERFACE SOURCE ADDRESS PROTO PORT(S) IPSEC MARK
$ADSL_IF 10.10.100.3 10.10.90.3 $DSL_IF 10.10.90.3 10.10.100.3 $ADSL_IF 10.10.110.0/24 $DSL_IF 10.10.110.0/24 $ADSL_IF 10.10.80.0/24 $DSL_IF 10.10.80.0/24 /etc/shorewall/tunnels: #TYPE ZONE GATEWAY GATEWAY # ZONE openvpnserver:1194 net 0.0.0.0/0 /etc/shorewall/providers:#NAME NUMBER MARK DUPLICATE INTERFACE GATEWAY OPTIONS COPY Squid 1 202 - $LAN_IF 10.10.80.81 loose Isp_6M 2 0x6 main $ADSL_IF 10.10.90.3 track,balance=9 eth0,eth3 Isp_1M 3 0x2 main $DSL_IF 10.10.100.3 track,balance=1 eth0,eth3
/etc/shorewall/tcrules:#MARK SOURCE DEST PROTO DEST SOURCE USER TEST LENGTH TOS
# PORT(S) PORT(S) 0x6:P 10.10.80.0/24 - tcp 80,443 #All outgoing traffic of port 1723 and gre protocol is routed through isp_6M 0x6:P 10.10.80.10 - tcp 1723 0x6:P 10.10.80.10 - udp 1723 0x6:P 10.10.80.10 - gre 0x6:P 10.10.80.10 - 47 /etc/shorewall/route_rules: #SOURCE DEST PROVIDER PRIORITY $DMZ_IF - Isp_1M 1000 /etc/shorewall/rules: (just what is concerned to pptp client config): ACCEPT loc:$IP_GALILEO net ACCEPT loc:$IP_GALILEO net 47 ACCEPT loc:$IP_GALILEO net gre ACCEPT loc:$IP_GALILEO net tcp 1723 ACCEPT $FW net 47 ACCEPT $FW net gre ACCEPT $FW net tcp 1723 DNAT:info net:$DSL_IF loc:$IP_GALILEO 47 DNAT:info net:$DSL_IF loc:$IP_GALILEO tcp 1723 DNAT:info net:$DSL_IF loc:$IP_GALILEO greI also attach a shorewall dump file to analyze and troubleshoot my network config. I would be pleasant if someone could help me with these problem.
Best regards, Miguel A. Velasco IT Manager.
shorewall_4.4.6.dump.gz
Description: application/gzip
------------------------------------------------------------------------------ SOLARIS 10 is the OS for Data Centers - provides features such as DTrace, Predictive Self Healing and Award Winning ZFS. Get Solaris 10 NOW http://p.sf.net/sfu/solaris-dev2dev
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
