Miguel A. Velasco wrote: > I've an openvpn server running on the firewall and working on eth1 and > I´d like to config my firewall to let a pptp client, running on my LAN > (with IP 10.10.80.10), connect to a pptp remote vpn server of a > different company. But I am not able to do this, an that´s my problem :)
Can we have a few more details please besides "it doesn't work"? > /etc/shorewall/policy: > #SOURCE DEST POLICY LOG LIMIT:BURST > # LEVEL > loc net DROP info Very unfriendly policy for loc->net; much nicer for your local users if you use REJECT. > fw loc DROP info > fw net DROP info > fw dmz DROP info > loc dmz DROP info > ##OpenVPN ------ ## > vpn fw ACCEPT info > fw vpn ACCEPT info > net vpn DROP info > loc vpn ACCEPT info > vpn loc ACCEPT info > vpn net DROP info > vpn dmz DROP info > ##DMZ ---------- ## > dmz net DROP info > dmz fw DROP info > dmz loc DROP info > dmz vpn DROP info > dmz all DROP info > ## ------------- > net all DROP info > all all REJECT info > > /etc/shorewall/params: > LAN_IF=eth0 > ADSL_IF=eth1 > DSL_IF=eth2 > DMZ_IF=eth3 > IP_GALILEO=10.10.80.10 --> it´s the pptp client. > > /etc/shorewall/masq: > #INTERFACE SOURCE ADDRESS PROTO PORT(S) > IPSEC MARK > $ADSL_IF 10.10.100.3 10.10.90.3 > $DSL_IF 10.10.90.3 10.10.100.3 > $ADSL_IF 10.10.110.0/24 > $DSL_IF 10.10.110.0/24 > $ADSL_IF 10.10.80.0/24 > $DSL_IF 10.10.80.0/24 Given that your external IP addresses are in the RFC 1918 range, you are doing "double NAT" of all of your traffic. Do you know for certain that this works in a single-ISP configuration? > /etc/shorewall/tcrules: > #MARK SOURCE DEST PROTO DEST SOURCE USER > TEST LENGTH TOS > # PORT(S) PORT(S) > 0x6:P 10.10.80.0/24 - tcp 80,443 > #All outgoing traffic of port 1723 and gre protocol is routed through > isp_6M > 0x6:P 10.10.80.10 - tcp 1723 > 0x6:P 10.10.80.10 - udp 1723 > 0x6:P 10.10.80.10 - gre > 0x6:P 10.10.80.10 - 47 Last rule is redundant -- gre == 47 > > /etc/shorewall/route_rules: > #SOURCE DEST PROVIDER PRIORITY > $DMZ_IF - Isp_1M 1000 > > /etc/shorewall/rules: (just what is concerned to pptp client config): > ACCEPT loc:$IP_GALILEO net All of the following rules are redundant > ACCEPT loc:$IP_GALILEO net 47 > ACCEPT loc:$IP_GALILEO net gre > ACCEPT loc:$IP_GALILEO net tcp 1723 > ACCEPT $FW net 47 > ACCEPT $FW net gre > ACCEPT $FW net tcp 1723 > DNAT:info net:$DSL_IF loc:$IP_GALILEO 47 > DNAT:info net:$DSL_IF loc:$IP_GALILEO tcp 1723 > DNAT:info net:$DSL_IF loc:$IP_GALILEO gre > > > I also attach a shorewall dump file to analyze and troubleshoot my > network config. I would be pleasant if someone could help me with these > problem. I think you will need to use a packet sniffer to see what is happening on the external interface. Other than the fact that you have many unneeded rules, I don't see anything wrong with your Shorewall setup. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ SOLARIS 10 is the OS for Data Centers - provides features such as DTrace, Predictive Self Healing and Award Winning ZFS. Get Solaris 10 NOW http://p.sf.net/sfu/solaris-dev2dev
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
