On 09/14/2013 07:18 AM, Tom Eastep wrote: > > I can't even get this to work when Shorewall is cleared. See attached log: >
Okay -- I did another experiment on a Virtual Machine running Foobar 6 (a derivative of RHEL 6). It has two uplinks - one wired (eth0) and one wireless (eth1). /etc/shorewall/shorewall.conf: ... USE_DEFAULT_RT=Yes ... TRACK_PROVIDERS=Yes ... TC_BITS=14 PROVIDER_BITS=8 PROVIDER_OFFSET=0 MASK_BITS=16 ZONE_BITS=0 /etc/shorewall/providers: #NAME NUMBER MARK DUPLICATE INTERFACE GATEWAY OPTIONS COPY LAN 1 - - eth0 detect balance WLAN 2 - - eth1 detect fallback [root@foobar64 quagga]# service zebra start Starting zebra: [ OK ] [root@foobar64 quagga]# vtysh Hello, this is Quagga (version 0.99.15). Copyright 1996-2005 Kunihiro Ishiguro, et al. foobar64.shorewall.net# exit [root@foobar64 quagga]# vtysh -c "ip show route" % Unknown command. [root@foobar64 quagga]# vtysh -c "ip route show" % Unknown command. [root@foobar64 quagga]# vtysh -c "show ip route" Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF, I - ISIS, B - BGP, > - selected route, * - FIB route C>* 10.0.0.0/24 is directly connected, eth1 C>* 127.0.0.0/8 is directly connected, lo C>* 172.20.1.0/24 is directly connected, eth0 [root@foobar64 quagga]# vtysh Hello, this is Quagga (version 0.99.15). Copyright 1996-2005 Kunihiro Ishiguro, et al. foobar64.shorewall.net# conf t foobar64.shorewall.net(config)# ip route 8.8.8.8/32 172.20.1.254 foobar64.shorewall.net(config)# quit % Unknown command. foobar64.shorewall.net(config)# vtysh -c "show ip route" % Unknown command. foobar64.shorewall.net(config)# exit foobar64.shorewall.net# exit [root@foobar64 quagga]# vtysh -c "show ip route" Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF, I - ISIS, B - BGP, > - selected route, * - FIB route S>* 8.8.8.8/32 [1/0] via 172.20.1.254, eth0 C>* 10.0.0.0/24 is directly connected, eth1 C>* 127.0.0.0/8 is directly connected, lo C>* 172.20.1.0/24 is directly connected, eth0 [root@foobar64 quagga]# This is how I would have expected it to work. USE_DEFAULT_RT=Yes has the advantage that the 'main' table is traversed first. So all of the routes added by Zebra will be seen prior to jumping to the provider-specific tables; those tables contain only default routes. -- [root@foobar64 quagga]# shorewall show routing Shorewall 4.5.20 Routing at foobar64.shorewall.net - Sat Sep 14 08:11:14 PDT 2013 Routing Rules 0: from all lookup local 999: from all lookup main 10000: from all fwmark 0x1/0xff lookup LAN 10001: from all fwmark 0x2/0xff lookup WLAN 20000: from 172.20.1.152 lookup LAN 20000: from 10.0.0.5 lookup WLAN 32765: from all lookup balance 32767: from all lookup default Table balance: default via 172.20.1.254 dev eth0 Table default: 10.0.0.1 dev eth1 scope link default via 10.0.0.1 dev eth1 src 10.0.0.5 metric 2 Table LAN: 172.20.1.254 dev eth0 scope link src 172.20.1.152 default via 172.20.1.254 dev eth0 src 172.20.1.152 Table local: local 172.20.1.152 dev eth0 proto kernel scope host src 172.20.1.152 local 127.0.0.1 dev lo proto kernel scope host src 127.0.0.1 local 10.0.0.5 dev eth1 proto kernel scope host src 10.0.0.5 broadcast 172.20.1.255 dev eth0 proto kernel scope link src 172.20.1.152 broadcast 172.20.1.0 dev eth0 proto kernel scope link src 172.20.1.152 broadcast 127.255.255.255 dev lo proto kernel scope link src 127.0.0.1 broadcast 127.0.0.0 dev lo proto kernel scope link src 127.0.0.1 broadcast 10.0.0.255 dev eth1 proto kernel scope link src 10.0.0.5 broadcast 10.0.0.0 dev eth1 proto kernel scope link src 10.0.0.5 local 127.0.0.0/8 dev lo proto kernel scope host src 127.0.0.1 Table main: 8.8.8.8 via 172.20.1.254 dev eth0 proto zebra 172.20.1.254 dev eth0 scope link src 172.20.1.152 10.0.0.1 dev eth1 scope link src 10.0.0.5 172.20.1.0/24 dev eth0 proto kernel scope link src 172.20.1.152 10.0.0.0/24 dev eth1 proto kernel scope link src 10.0.0.5 metric 1 Table WLAN: 10.0.0.1 dev eth1 scope link src 10.0.0.5 default via 10.0.0.1 dev eth1 src 10.0.0.5 [root@foobar64 quagga]# shorewall version -a shorewall-core: 4.5.20 shorewall: 4.5.20 shorewall6: 4.5.20 [root@foobar64 quagga]# FWIW, my failed experiments were on my main gateway that runs Debian 7. I've attached the Shorewall configuration directory. Regards, -Tom Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
shorewall.tgz
Description: GNU Zip compressed data
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ LIMITED TIME SALE - Full Year of Microsoft Training For Just $49.99! 1,500+ hours of tutorials including VisualStudio 2012, Windows 8, SharePoint 2013, SQL 2012, MVC 4, more. BEST VALUE: New Multi-Library Power Pack includes Mobile, Cloud, Java, and UX Design. Lowest price ever! Ends 9/22/13. http://pubads.g.doubleclick.net/gampad/clk?id=64545871&iu=/4140/ostg.clktrk
_______________________________________________ Shorewall-users mailing list Shorewall-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/shorewall-users