Hello again,
I added the following masq rule
#INTERFACE:DEST SOURCE ADDRESS PROTO PORT(S)
IPSEC MARK
tun0 192.168.1.210 - -
- - 2
and disabled ROUTE_FILTER in shorewall.conf.
Everything seems to be working now!
Thanks a lot for your help!
MG
--
Marcello Giordano
[email protected]
On Fri, May 2, 2014, at 19:02, Tom Eastep wrote:
> On 5/2/2014 2:29 PM, Marcello Giordano wrote:
> > Ok, I ran a few tests with tcpdump (nothing relevant in the shorewall
> > logs).
> > I'm really new to all of this so please forgive my non-technical
> > approach.
> >
> > ** From my regular user account on the $FW, no tcrules:
> >
> > ping goes through the wlan1 interface (source marked as 192.168.1.210),
> > wget goes through the interface specified with the bind option.
> > everything as expected.
> >
> > ** From the rtorrent user (marked in tcrules to go through the vpn):
> >
> > pinging ip addresses goes through wlan1 (source 192.168.1.210)..
> > pinging web addresses, nothing
> >
> > testing with wget:
> > wget --bind-address=10.9.0.10 http://ipecho.net/plain
> >
> > tcpdump -nei tun0 shows:
> >
> > 17:21:27.691855 ip: 192.168.1.210.58112 > 8.8.4.4.53: 47362+ A?
> > ipecho.net. (28)
> > 17:21:27.693208 ip: 192.168.1.210.58112 > 8.8.4.4.53: 15632+ AAAA?
> > ipecho.net. (28)
> >
> > and nothing else.. I guess it's trying to contact google's dns servers
> > whit no success..
> > and source is marked as 192.168.1.210 even when I explicitly bound wget
> > to the tun0 ip address..
> > I get exactly the same results without binding wget to any interface.
>
> You need a masq rule for tun0.
>
> -Tom
> --
> Tom Eastep \ When I die, I want to go like my Grandfather who
> Shoreline, \ died peacefully in his sleep. Not screaming like
> Washington, USA \ all of the passengers in his car
> http://shorewall.net \________________________________________________
>
> ------------------------------------------------------------------------------
> "Accelerate Dev Cycles with Automated Cross-Browser Testing - For FREE
> Instantly run your Selenium tests across 300+ browser/OS combos. Get
> unparalleled scalability from the best Selenium testing platform
> available.
> Simple to use. Nothing to install. Get started now for free."
> http://p.sf.net/sfu/SauceLabs
> _______________________________________________
> Shorewall-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/shorewall-users
> Email had 1 attachment:
> + signature.asc
> 1k (application/pgp-signature)
------------------------------------------------------------------------------
"Accelerate Dev Cycles with Automated Cross-Browser Testing - For FREE
Instantly run your Selenium tests across 300+ browser/OS combos.
Get unparalleled scalability from the best Selenium testing platform available
Simple to use. Nothing to install. Get started now for free."
http://p.sf.net/sfu/SauceLabs
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
