On Thu, Sep 05, 2013 at 04:43:41PM PDT, Tom Eastep spake thusly: > On 9/3/2013 11:49 AM, Tracy Reed wrote: > > Then my masq file: > > > > eth1 10.0.2.32/32 207.71.189.254 # mail server > > eth1 10.0.2.0/24 207.71.189.130 # everything else > > You have no masq entry for eth2?
No, I did not at the time. But now I see that I do need such an entry. > What is your setting of MARK_IN_FORWARD_CHAIN in shorewall.conf? If it > is 'Yes', then you need to add ':P' to the mark values. It is No. > Is the default gateway set correctly on spider? Yes. > No. If traffic with a private source IP address exits on an Internet > interface, then the masq entry for that interface rewrites the source > address so that return traffic can be routed correctly back to your > Shorewall box. So I see... > I always use rtrules when they are sufficient. So if you are selecting > your provider based solely on source IP address, then i like rtrules. Between your comments and those of Dominic Benson and Lee Brown I now have a complete understanding of the problem and what I was doing wrong. I added the appropriate masq and rtrules entries and now it works perfectly! Thank you all! And thank you Tom for an awesome firewall configuration system. I have been using Shorewall for around 10 years now! -- Tracy Reed
pgp4oyES1flP7.pgp
Description: PGP signature
------------------------------------------------------------------------------ How ServiceNow helps IT people transform IT departments: 1. Consolidate legacy IT systems to a single system of record for IT 2. Standardize and globalize service processes across IT 3. Implement zero-touch automation to replace manual, redundant tasks http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
