On Thu, 2010-06-17 at 10:35 -0600, Jeff Taylor wrote:
> I assume you're referring to this portion?
>
> 25801 1979K MASQUERADE all -- * * 10.0.0.0/16
> 0.0.0.0/0
> 2212 112K SNAT all -- * * 10.10.0.0/16 0.0.0.0/0
> to:216.87.84.211
> 39 2340 SNAT all -- * * 10.20.0.0/16 0.0.0.0/0
> to:216.87.84.212
>
>
> I made the change, but it had no effect. I pasted a new 'shorewall
> dump' at the same location. Any other thoughts?
>
well..
Chain DSL_dnat (1 references)
2502K 170M DNAT udp -- * * 0.0.0.0/0 216.87.84.211
udp dpt:53 to:10.0.0.211
478 25240 DNAT tcp -- * * 0.0.0.0/0
216.87.84.211 tcp dpt:53 to:10.0.0.211
OK, you have the inbound dnat'd on a secondary address
Chain eth0_masq (1 references)
683K 52M SNAT udp -- * * 10.0.0.9
0.0.0.0/0 udp dpt:53 to:216.87.84.211
547 32820 SNAT tcp -- * * 10.0.0.9
0.0.0.0/0 tcp dpt:53 to:216.87.84.211
The return traffic from 10.0.0.9, that was redirected at the firewall,
would have a source port of 53 coming from 10.0.0.9, no? Then wouldn't
that be:
683K 52M SNAT udp -- * * 10.0.0.9 0.0.0.0/0
udp spt:53 to:216.87.84.211
547 32820 SNAT tcp -- * * 10.0.0.9
0.0.0.0/0 tcp spt:53 to:216.87.84.211
or then the next rule gets applied
25801 1979K MASQUERADE all -- * * 10.0.0.0/16 0.0.0.0/0
which would select 216.87.84.210 as the source address as the primary
address on that interface.
I'd like to help more now, but I require some sleep, up in ~6 hours.
Jerry
------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate
GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the
lucky parental unit. See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
