On Fri, Jul 25, 2014, at 07:40 AM, Tom Eastep wrote:
> ...
Watching that example of stepping through the flow was quite useful; Something
to study.
> The configuration on the SERVER is now correct and the issue is on the CLIENT.
OK
> What is the shorewall.conf setting for ROUTE_FILTER on the CLIENT? If it
> is 'Yes' then set it to 'No' and restart Shorewall. If it doesn't work
> after that change, then please run the test again but this time forward
> a dump taken on the CLIENT.
> What is the shorewall.conf setting for ROUTE_FILTER on the CLIENT? If it
> is 'Yes' then set it to 'No' and restart Shorewall.
already
ROUTE_FILTER=No
> If it doesn't work after that change, then please run the test again
> but this time forward a dump taken on the CLIENT.
at CLIENT
shorewall reset
from external
telnet S.S.S.S 25
at CLIENT
shorewall dump
Shorewall Lite 4.6.2.1 Dump at client - Fri Jul 25 10:52:23 PDT 2014
Shorewall Lite is running
State:Started (Fri Jul 25 10:51:33 PDT 2014) from
/usr/local/etc/shorewall/client/ (/var/lib/shorewall-lite/firewall compiled by
Shorewall version 4.6.2.1)
Counters reset Fri Jul 25 10:51:57 PDT 2014
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
24 3022 net2fw all -- eth0 * 0.0.0.0/0
0.0.0.0/0
1 32 lan2fw all -- eth1 * 0.0.0.0/0
0.0.0.0/0
0 0 vpn12fw all -- tun1 * 0.0.0.0/0
0.0.0.0/0
0 0 ACCEPT all -- lo * 0.0.0.0/0
0.0.0.0/0
0 0 Reject all -- * * 0.0.0.0/0
0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 6 prefix "SW:INPUT:REJECT "
0 0 reject all -- * * 0.0.0.0/0
0.0.0.0/0 [goto]
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
0 0 TCPMSS tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
13 1417 net_frwd all -- eth0 * 0.0.0.0/0
0.0.0.0/0
19 1683 lan_frwd all -- eth1 * 0.0.0.0/0
0.0.0.0/0
0 0 vpn1_frwd all -- tun1 * 0.0.0.0/0
0.0.0.0/0
0 0 Reject all -- * * 0.0.0.0/0
0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 6 prefix "SW:FORWARD:REJECT "
0 0 reject all -- * * 0.0.0.0/0
0.0.0.0/0 [goto]
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
20 2328 fw2net all -- * eth0 0.0.0.0/0
0.0.0.0/0
0 0 fw2lan all -- * eth1 0.0.0.0/0
0.0.0.0/0
0 0 fw2vpn1 all -- * tun1 0.0.0.0/0
0.0.0.0/0
0 0 fw2fw all -- * lo 0.0.0.0/0
0.0.0.0/0
0 0 Reject all -- * * 0.0.0.0/0
0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 6 prefix "SW:OUTPUT:REJECT "
0 0 reject all -- * * 0.0.0.0/0
0.0.0.0/0 [goto]
Chain Broadcast (2 references)
pkts bytes target prot opt in out source
destination
0 0 DROP all -- * * 0.0.0.0/0
0.0.0.0/0 ADDRTYPE match dst-type BROADCAST
1 32 DROP all -- * * 0.0.0.0/0
0.0.0.0/0 ADDRTYPE match dst-type MULTICAST
0 0 DROP all -- * * 0.0.0.0/0
0.0.0.0/0 ADDRTYPE match dst-type ANYCAST
Chain Drop (3 references)
pkts bytes target prot opt in out source
destination
2 96 all -- * * 0.0.0.0/0
0.0.0.0/0
2 96 Broadcast all -- * * 0.0.0.0/0
0.0.0.0/0
0 0 ACCEPT icmp -- * * 0.0.0.0/0
0.0.0.0/0 icmptype 3 code 4 /* Needed ICMP types */
0 0 ACCEPT icmp -- * * 0.0.0.0/0
0.0.0.0/0 icmptype 11 /* Needed ICMP types */
0 0 DROP all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate INVALID
0 0 DROP tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp flags:!0x17/0x02
1 64 DROP udp -- * * 0.0.0.0/0
0.0.0.0/0 udp spt:53 /* Late DNS Replies */
Chain Reject (7 references)
pkts bytes target prot opt in out source
destination
0 0 all -- * * 0.0.0.0/0
0.0.0.0/0
0 0 Broadcast all -- * * 0.0.0.0/0
0.0.0.0/0
0 0 ACCEPT icmp -- * * 0.0.0.0/0
0.0.0.0/0 icmptype 3 code 4 /* Needed ICMP types */
0 0 ACCEPT icmp -- * * 0.0.0.0/0
0.0.0.0/0 icmptype 11 /* Needed ICMP types */
0 0 DROP all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate INVALID
0 0 DROP tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp flags:!0x17/0x02
0 0 DROP udp -- * * 0.0.0.0/0
0.0.0.0/0 udp spt:53 /* Late DNS Replies */
Chain dropNotSyn (1 references)
pkts bytes target prot opt in out source
destination
0 0 DROP tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp flags:!0x17/0x02
Chain dynamic (6 references)
pkts bytes target prot opt in out source
destination
Chain fw2fw (1 references)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT all -- * * 0.0.0.0/0
0.0.0.0/0
Chain fw2lan (1 references)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT all -- * * 0.0.0.0/0
0.0.0.0/0
Chain fw2net (1 references)
pkts bytes target prot opt in out source
destination
20 2328 ACCEPT all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT udp -- * * C.C.C.C
S.S.S.S udp spt:1194
0 0 ACCEPT tcp -- * * C.C.C.C
S.S.S.S tcp spt:1194
0 0 ACCEPT udp -- * * 0.0.0.0/0
0.0.0.0/0 udp dpts:33434:33524 /* Trcrt */
0 0 ACCEPT icmp -- * * 0.0.0.0/0
0.0.0.0/0 icmptype 8 /* Trcrt */
0 0 ACCEPT icmp -- * * 0.0.0.0/0
0.0.0.0/0
0 0 ACCEPT tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp dpt:53
0 0 ACCEPT udp -- * * 0.0.0.0/0
0.0.0.0/0 udp dpt:53
0 0 ACCEPT all -- * * 0.0.0.0/0
0.0.0.0/0
Chain fw2vpn1 (1 references)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT all -- * * 0.0.0.0/0
0.0.0.0/0
Chain lan2fw (1 references)
pkts bytes target prot opt in out source
destination
1 32 dynamic all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate INVALID,NEW,UNTRACKED
0 0 tcpflags tcp -- * * 0.0.0.0/0
0.0.0.0/0
0 0 ACCEPT all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate RELATED,ESTABLISHED
1 32 ACCEPT all -- * * 0.0.0.0/0
0.0.0.0/0
Chain lan2net (1 references)
pkts bytes target prot opt in out source
destination
19 1683 ACCEPT all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT udp -- * * 0.0.0.0/0
0.0.0.0/0 udp dpts:33434:33524 /* Trcrt */
0 0 ACCEPT icmp -- * * 0.0.0.0/0
0.0.0.0/0 icmptype 8 /* Trcrt */
0 0 ACCEPT all -- * * 0.0.0.0/0
0.0.0.0/0
Chain lan2vpn1 (1 references)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT icmp -- * * 0.0.0.0/0
0.0.0.0/0 icmptype 8 /* Ping */
0 0 Reject all -- * * 0.0.0.0/0
0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 6 prefix "SW:lan2vpn1:REJECT "
0 0 reject all -- * * 0.0.0.0/0
0.0.0.0/0 [goto]
Chain lan_frwd (1 references)
pkts bytes target prot opt in out source
destination
0 0 sfilter all -- * eth1 0.0.0.0/0
0.0.0.0/0 [goto]
0 0 dynamic all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate INVALID,NEW,UNTRACKED
18 1155 tcpflags tcp -- * * 0.0.0.0/0
0.0.0.0/0
19 1683 lan2net all -- * eth0 0.0.0.0/0
0.0.0.0/0
0 0 lan2vpn1 all -- * tun1 0.0.0.0/0
0.0.0.0/0
Chain logdrop (0 references)
pkts bytes target prot opt in out source
destination
0 0 LOG all -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 7 prefix "SW:logdrop:DROP "
0 0 DROP all -- * * 0.0.0.0/0
0.0.0.0/0
Chain logreject (0 references)
pkts bytes target prot opt in out source
destination
0 0 LOG all -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 7 prefix "SW:logreject:REJECT "
0 0 reject all -- * * 0.0.0.0/0
0.0.0.0/0
Chain net2fw (1 references)
pkts bytes target prot opt in out source
destination
9 928 dynamic all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate INVALID,NEW,UNTRACKED
9 928 smurfs all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate INVALID,NEW,UNTRACKED
0 0 tcpflags tcp -- * * 0.0.0.0/0
0.0.0.0/0
15 2094 ACCEPT all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT udp -- * * S.S.S.S
C.C.C.C udp dpt:1194
0 0 ACCEPT tcp -- * * S.S.S.S
C.C.C.C tcp dpt:1194
0 0 dropNotSyn tcp -- * * 0.0.0.0/0
0.0.0.0/0
7 832 ACCEPT icmp -- * * 0.0.0.0/0
0.0.0.0/0 icmptype 8 limit: avg 5/sec burst 100 /* Ping */
2 96 Drop all -- * * 0.0.0.0/0
0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 6 prefix "SW:net2fw:DROP "
0 0 DROP all -- * * 0.0.0.0/0
0.0.0.0/0
Chain net2lan (1 references)
pkts bytes target prot opt in out source
destination
13 1417 ACCEPT all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT icmp -- * * 0.0.0.0/0
0.0.0.0/0 icmptype 8 limit: avg 5/sec burst 100 /* Ping */
0 0 Drop all -- * * 0.0.0.0/0
0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 6 prefix "SW:net2lan:DROP "
0 0 DROP all -- * * 0.0.0.0/0
0.0.0.0/0
Chain net2vpn1 (1 references)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT icmp -- * * 0.0.0.0/0
0.0.0.0/0 icmptype 8 limit: avg 5/sec burst 100 /* Ping */
0 0 Drop all -- * * 0.0.0.0/0
0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 6 prefix "SW:net2vpn1:DROP "
0 0 DROP all -- * * 0.0.0.0/0
0.0.0.0/0
Chain net_frwd (1 references)
pkts bytes target prot opt in out source
destination
0 0 sfilter all -- * eth0 0.0.0.0/0
0.0.0.0/0 [goto]
0 0 dynamic all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate INVALID,NEW,UNTRACKED
0 0 smurfs all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate INVALID,NEW,UNTRACKED
12 1091 tcpflags tcp -- * * 0.0.0.0/0
0.0.0.0/0
13 1417 net2lan all -- * eth1 0.0.0.0/0
0.0.0.0/0
0 0 net2vpn1 all -- * tun1 0.0.0.0/0
0.0.0.0/0
Chain reject (12 references)
pkts bytes target prot opt in out source
destination
0 0 DROP all -- * * 0.0.0.0/0
0.0.0.0/0 ADDRTYPE match src-type BROADCAST
0 0 DROP all -- * * 224.0.0.0/4
0.0.0.0/0
0 0 DROP 2 -- * * 0.0.0.0/0
0.0.0.0/0
0 0 REJECT tcp -- * * 0.0.0.0/0
0.0.0.0/0 reject-with tcp-reset
0 0 REJECT udp -- * * 0.0.0.0/0
0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT icmp -- * * 0.0.0.0/0
0.0.0.0/0 reject-with icmp-host-unreachable
0 0 REJECT all -- * * 0.0.0.0/0
0.0.0.0/0 reject-with icmp-host-prohibited
Chain sfilter (3 references)
pkts bytes target prot opt in out source
destination
0 0 LOG all -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 6 prefix "SW:sfilter:DROP "
0 0 DROP all -- * * 0.0.0.0/0
0.0.0.0/0
Chain shorewall (0 references)
pkts bytes target prot opt in out source
destination
0 0 all -- * * 0.0.0.0/0
0.0.0.0/0 recent: SET name: %CURRENTTIME side: source mask:
255.255.255.255
Chain smurfs (2 references)
pkts bytes target prot opt in out source
destination
0 0 RETURN all -- * * 0.0.0.0
0.0.0.0/0
0 0 DROP all -- * * 0.0.0.0/0
0.0.0.0/0 ADDRTYPE match src-type BROADCAST
0 0 DROP all -- * * 224.0.0.0/4
0.0.0.0/0
Chain tcpflags (6 references)
pkts bytes target prot opt in out source
destination
0 0 DROP tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp flags:0x3F/0x29
0 0 DROP tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp flags:0x3F/0x00
0 0 DROP tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp flags:0x06/0x06
0 0 DROP tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp flags:0x03/0x03
0 0 DROP tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp spt:0 flags:0x17/0x02
Chain vpn12fw (1 references)
pkts bytes target prot opt in out source
destination
0 0 dynamic all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate INVALID,NEW,UNTRACKED
0 0 tcpflags tcp -- * * 0.0.0.0/0
0.0.0.0/0
0 0 ACCEPT all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT icmp -- * * 0.0.0.0/0
0.0.0.0/0 icmptype 8 /* Ping */
0 0 Reject all -- * * 0.0.0.0/0
0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 6 prefix "SW:vpn12fw:REJECT "
0 0 reject all -- * * 0.0.0.0/0
0.0.0.0/0 [goto]
Chain vpn12lan (1 references)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT icmp -- * * 0.0.0.0/0
0.0.0.0/0 icmptype 8 /* Ping */
0 0 Reject all -- * * 0.0.0.0/0
0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 6 prefix "SW:vpn12lan:REJECT "
0 0 reject all -- * * 0.0.0.0/0
0.0.0.0/0 [goto]
Chain vpn12net (1 references)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 Reject all -- * * 0.0.0.0/0
0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 6 prefix "SW:vpn12net:REJECT "
0 0 reject all -- * * 0.0.0.0/0
0.0.0.0/0 [goto]
Chain vpn1_frwd (1 references)
pkts bytes target prot opt in out source
destination
0 0 sfilter all -- * tun1 0.0.0.0/0
0.0.0.0/0 [goto]
0 0 dynamic all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate INVALID,NEW,UNTRACKED
0 0 tcpflags tcp -- * * 0.0.0.0/0
0.0.0.0/0
0 0 vpn12net all -- * eth0 0.0.0.0/0
0.0.0.0/0
0 0 vpn12lan all -- * eth1 0.0.0.0/0
0.0.0.0/0
ARP rules
Chain INPUT (policy ACCEPT 1378 packets, 38584 bytes)
Chain OUTPUT (policy ACCEPT 1322 packets, 37016 bytes)
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
Log (/var/log/shorewall/shorewall)
NAT Table
Chain PREROUTING (policy ACCEPT 13 packets, 1248 bytes)
pkts bytes target prot opt in out source
destination
10 1056 net_dnat all -- eth0 * 0.0.0.0/0
0.0.0.0/0
Chain INPUT (policy ACCEPT 8 packets, 960 bytes)
pkts bytes target prot opt in out source
destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
0 0 EXT_IF_masq all -- * eth0 0.0.0.0/0
0.0.0.0/0
Chain EXT_IF_masq (1 references)
pkts bytes target prot opt in out source
destination
0 0 SNAT all -- * * 192.168.1.0/22
0.0.0.0/0 to:C.C.C.C
Chain net_dnat (1 references)
pkts bytes target prot opt in out source
destination
0 0 DNAT tcp -- * * 0.0.0.0/0
10.0.0.2 multiport dports 25,587 to:192.168.1.2
Mangle Table
Chain PREROUTING (policy ACCEPT 60 packets, 6346 bytes)
pkts bytes target prot opt in out source
destination
60 6346 tcpre all -- * * 0.0.0.0/0
0.0.0.0/0
Chain INPUT (policy ACCEPT 25 packets, 3054 bytes)
pkts bytes target prot opt in out source
destination
25 3054 tcin all -- * * 0.0.0.0/0
0.0.0.0/0
Chain FORWARD (policy ACCEPT 32 packets, 3100 bytes)
pkts bytes target prot opt in out source
destination
32 3100 MARK all -- * * 0.0.0.0/0
0.0.0.0/0 MARK and 0xffffff00
32 3100 tcfor all -- * * 0.0.0.0/0
0.0.0.0/0
Chain OUTPUT (policy ACCEPT 20 packets, 2328 bytes)
pkts bytes target prot opt in out source
destination
20 2328 tcout all -- * * 0.0.0.0/0
0.0.0.0/0
Chain POSTROUTING (policy ACCEPT 52 packets, 5428 bytes)
pkts bytes target prot opt in out source
destination
52 5428 tcpost all -- * * 0.0.0.0/0
0.0.0.0/0
Chain tcfor (1 references)
pkts bytes target prot opt in out source
destination
Chain tcin (1 references)
pkts bytes target prot opt in out source
destination
Chain tcout (1 references)
pkts bytes target prot opt in out source
destination
Chain tcpost (1 references)
pkts bytes target prot opt in out source
destination
Chain tcpre (1 references)
pkts bytes target prot opt in out source
destination
Raw Table
Chain PREROUTING (policy ACCEPT 113 packets, 12047 bytes)
pkts bytes target prot opt in out source
destination
0 0 CT tcp -- * * 0.0.0.0/0
0.0.0.0/0 multiport dports 25,587 match-set SPAM_NET src CT notrack
0 0 DROP tcp -- * * 0.0.0.0/0
0.0.0.0/0 multiport dports 25,587 match-set SPAM_NET src
Chain OUTPUT (policy ACCEPT 46 packets, 5491 bytes)
pkts bytes target prot opt in out source
destination
Conntrack Table (70 out of 65536)
ipv4 2 udp 17 179 src=C.C.C.C dst=S.S.S.S sport=1194
dport=1194 src=S.S.S.S dst=C.C.C.C sport=1194 dport=1194 [ASSURED] mark=0
zone=0 use=2
ipv4 2 unknown 2 585 src=0.0.0.0 dst=224.0.0.1 [UNREPLIED]
src=224.0.0.1 dst=0.0.0.0 mark=0 zone=0 use=2
IP Configuration
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
group default
inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast
state UP group default qlen 1000
inet C.C.C.C/24 brd C.C.C.255 scope global eth0
valid_lft forever preferred_lft forever
6: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast
state UP group default qlen 1000
inet 192.168.1.1/24 brd 192.168.1.255 scope global eth1
valid_lft forever preferred_lft forever
12: tun1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc
pfifo_fast state UP group default qlen 100
inet 10.0.0.2/24 brd 10.0.0.255 scope global tun1
valid_lft forever preferred_lft forever
IP Stats
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
mode DEFAULT group default
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
RX: bytes packets errors dropped overrun mcast
166849 1560 0 0 0 0
TX: bytes packets errors dropped carrier collsns
166849 1560 0 0 0 0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast
state UP mode DEFAULT group default qlen 1000
link/ether 6c:f0:49:de:d7:a6 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
120121417 112651 0 0 0 0
TX: bytes packets errors dropped carrier collsns
10042166 81470 0 0 0 0
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast
state UP mode DEFAULT group default qlen 1000
link/ether d8:eb:97:b0:a2:f0 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
8904681 72484 0 1 0 0
TX: bytes packets errors dropped carrier collsns
44520424 76676 0 0 0 0
12: tun1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc
pfifo_fast state UP mode DEFAULT group default qlen 100
link/none
RX: bytes packets errors dropped overrun mcast
5120 88 0 0 0 0
TX: bytes packets errors dropped carrier collsns
1201 20 0 0 0 0
Bridges
bridge name bridge id STP enabled interfaces
Routing Rules
0: from all lookup local
32766: from all lookup main
32767: from all lookup default
Table default:
Table local:
local C.C.C.C dev eth0 proto kernel scope host src C.C.C.C
local 127.0.0.1 dev lo proto kernel scope host src 127.0.0.1
local 10.0.0.2 dev tun1 proto kernel scope host src 10.0.0.2
broadcast C.C.C.255 dev eth0 proto kernel scope link src C.C.C.C
broadcast C.C.C.0 dev eth0 proto kernel scope link src C.C.C.C
broadcast 192.168.1.255 dev eth1 proto kernel scope link src 192.168.1.1
broadcast 127.255.255.255 dev lo proto kernel scope link src 127.0.0.1
broadcast 127.0.0.0 dev lo proto kernel scope link src 127.0.0.1
broadcast 10.0.0.255 dev tun1 proto kernel scope link src 10.0.0.2
broadcast 10.0.0.0 dev tun1 proto kernel scope link src 10.0.0.2
local 127.0.0.0/8 dev lo proto kernel scope host src 127.0.0.1
Table main:
C.C.C.0/24 dev eth0 proto kernel scope link src C.C.C.C
10.0.0.0/24 dev tun1 proto kernel scope link src 10.0.0.2
192.168.1.0/24 dev eth1 proto kernel scope link src 192.168.1.1
192.168.0.0/24 via 10.0.0.1 dev tun1
192.168.1.0/22 dev eth1 proto kernel scope link src 192.168.1.1
169.254.0.0/16 dev eth0 scope link
127.0.0.0/8 dev lo scope link
default via C.C.C.1 dev eth0
default via 192.168.1.1 dev eth1
Per-IP Counters
No IP Accounting Tables Defined
NF Accounting
No NF Accounting defined (nfacct not found)
Events
PFKEY SPD
No SPD entries.
PFKEY SAD
No SAD entries.
/proc
/proc/version = Linux version 3.15.6-2.gedc5ddf-default
(geeko@buildhost) (gcc version 4.8.1 20130909 [gcc-4_8-branch revision 202388]
(SUSE Linux) ) #1 SMP Mon Jul 21 15:37:46 UTC 2014 (edc5ddf)
/proc/sys/net/ipv4/ip_forward = 1
/proc/sys/net/ipv4/icmp_echo_ignore_all = 0
/proc/sys/net/ipv4/conf/all/proxy_arp = 0
/proc/sys/net/ipv4/conf/all/arp_filter = 0
/proc/sys/net/ipv4/conf/all/arp_ignore = 0
/proc/sys/net/ipv4/conf/all/rp_filter = 1
/proc/sys/net/ipv4/conf/all/log_martians = 0
/proc/sys/net/ipv4/conf/default/proxy_arp = 0
/proc/sys/net/ipv4/conf/default/arp_filter = 0
/proc/sys/net/ipv4/conf/default/arp_ignore = 0
/proc/sys/net/ipv4/conf/default/rp_filter = 0
/proc/sys/net/ipv4/conf/default/log_martians = 1
/proc/sys/net/ipv4/conf/dummy0/proxy_arp = 0
/proc/sys/net/ipv4/conf/dummy0/arp_filter = 0
/proc/sys/net/ipv4/conf/dummy0/arp_ignore = 0
/proc/sys/net/ipv4/conf/dummy0/rp_filter = 0
/proc/sys/net/ipv4/conf/dummy0/log_martians = 1
/proc/sys/net/ipv4/conf/eth0/proxy_arp = 0
/proc/sys/net/ipv4/conf/eth0/arp_filter = 0
/proc/sys/net/ipv4/conf/eth0/arp_ignore = 0
/proc/sys/net/ipv4/conf/eth0/rp_filter = 0
/proc/sys/net/ipv4/conf/eth0/log_martians = 1
/proc/sys/net/ipv4/conf/eth1/proxy_arp = 0
/proc/sys/net/ipv4/conf/eth1/arp_filter = 0
/proc/sys/net/ipv4/conf/eth1/arp_ignore = 0
/proc/sys/net/ipv4/conf/eth1/rp_filter = 0
/proc/sys/net/ipv4/conf/eth1/log_martians = 1
/proc/sys/net/ipv4/conf/ip6tnl0/proxy_arp = 0
/proc/sys/net/ipv4/conf/ip6tnl0/arp_filter = 0
/proc/sys/net/ipv4/conf/ip6tnl0/arp_ignore = 0
/proc/sys/net/ipv4/conf/ip6tnl0/rp_filter = 0
/proc/sys/net/ipv4/conf/ip6tnl0/log_martians = 1
/proc/sys/net/ipv4/conf/lo/proxy_arp = 0
/proc/sys/net/ipv4/conf/lo/arp_filter = 0
/proc/sys/net/ipv4/conf/lo/arp_ignore = 0
/proc/sys/net/ipv4/conf/lo/rp_filter = 0
/proc/sys/net/ipv4/conf/lo/log_martians = 1
/proc/sys/net/ipv4/conf/sit0/proxy_arp = 0
/proc/sys/net/ipv4/conf/sit0/arp_filter = 0
/proc/sys/net/ipv4/conf/sit0/arp_ignore = 0
/proc/sys/net/ipv4/conf/sit0/rp_filter = 0
/proc/sys/net/ipv4/conf/sit0/log_martians = 1
/proc/sys/net/ipv4/conf/sit1/proxy_arp = 0
/proc/sys/net/ipv4/conf/sit1/arp_filter = 0
/proc/sys/net/ipv4/conf/sit1/arp_ignore = 0
/proc/sys/net/ipv4/conf/sit1/rp_filter = 0
/proc/sys/net/ipv4/conf/sit1/log_martians = 1
/proc/sys/net/ipv4/conf/tun1/proxy_arp = 0
/proc/sys/net/ipv4/conf/tun1/arp_filter = 0
/proc/sys/net/ipv4/conf/tun1/arp_ignore = 0
/proc/sys/net/ipv4/conf/tun1/rp_filter = 0
/proc/sys/net/ipv4/conf/tun1/log_martians = 1
/proc/sys/net/ipv4/conf/vlan002/proxy_arp = 0
/proc/sys/net/ipv4/conf/vlan002/arp_filter = 0
/proc/sys/net/ipv4/conf/vlan002/arp_ignore = 0
/proc/sys/net/ipv4/conf/vlan002/rp_filter = 0
/proc/sys/net/ipv4/conf/vlan002/log_martians = 1
ARP
? (C.C.C.1) at 00:10:67:00:7a:82 [ether] on eth0
? (192.168.1.2) at 00:26:f2:ac:bf:c2 [ether] on eth1
? (S.S.S.S) at <incomplete> on eth1
? (C.C.C.C) at <incomplete> on eth0
Modules
ip_set 41059 3 ip_set_hash_net,ip_set_hash_ip,xt_set
ip_set_hash_ip 27298 15
ip_set_hash_net 35800 13
iptable_filter 12810 1
iptable_mangle 12695 1
iptable_nat 13011 1
iptable_raw 12678 1
ip_tables 27240 4
iptable_filter,iptable_mangle,iptable_nat,iptable_raw
ipt_ah 12806 0
ipt_CLUSTERIP 13633 0
ipt_ECN 12529 0
ipt_MASQUERADE 12880 0
ipt_REJECT 12541 4
ipt_rpfilter 12546 0
ipt_ULOG 14273 0
ip_tunnel 23809 1 sit
nf_conntrack 114222 38
nf_nat_ftp,nf_nat_irc,nf_nat_sip,nf_nat_amanda,xt_CT,nf_nat_snmp_basic,nf_conntrack_netbios_ns,nf_conntrack_proto_gre,xt_helper,ipt_MASQUERADE,nf_conntrack_proto_udplite,nf_nat,xt_state,xt_connlimit,nf_nat_h323,nf_nat_ipv4,nf_nat_ipv6,nf_nat_pptp,nf_nat_tftp,xt_conntrack,nf_conntrack_amanda,ipt_CLUSTERIP,nf_conntrack_proto_sctp,nf_conntrack_netlink,ip6table_nat,nf_conntrack_broadcast,xt_connmark,nf_conntrack_ftp,nf_conntrack_irc,nf_conntrack_sip,iptable_nat,nf_conntrack_h323,nf_conntrack_ipv4,nf_conntrack_ipv6,nf_conntrack_pptp,nf_conntrack_sane,nf_conntrack_snmp,nf_conntrack_tftp
nf_conntrack_amanda 13041 3 nf_nat_amanda
nf_conntrack_broadcast 12589 2
nf_conntrack_netbios_ns,nf_conntrack_snmp
nf_conntrack_ftp 18638 3 nf_nat_ftp
nf_conntrack_h323 73895 5 nf_nat_h323
nf_conntrack_ipv4 14806 48
nf_conntrack_ipv6 14798 1
nf_conntrack_irc 13518 3 nf_nat_irc
nf_conntrack_netbios_ns 12665 2
nf_conntrack_netlink 40281 0
nf_conntrack_pptp 15061 3 nf_nat_pptp
nf_conntrack_proto_gre 14216 1 nf_conntrack_pptp
nf_conntrack_proto_sctp 18822 0
nf_conntrack_proto_udplite 13281 0
nf_conntrack_sane 13143 2
nf_conntrack_sip 32556 3 nf_nat_sip
nf_conntrack_snmp 12857 3 nf_nat_snmp_basic
nf_conntrack_tftp 13121 3 nf_nat_tftp
nf_defrag_ipv4 12758 2 xt_TPROXY,nf_conntrack_ipv4
nf_defrag_ipv6 34768 2 xt_TPROXY,nf_conntrack_ipv6
nf_nat 21932 14
nf_nat_ftp,nf_nat_irc,nf_nat_sip,nf_nat_amanda,ipt_MASQUERADE,nf_nat_proto_gre,nf_nat_h323,nf_nat_ipv4,nf_nat_ipv6,nf_nat_pptp,nf_nat_tftp,xt_nat,ip6table_nat,iptable_nat
nf_nat_amanda 12491 0
nf_nat_ftp 12770 0
nf_nat_h323 17720 0
nf_nat_ipv4 13263 1 iptable_nat
nf_nat_ipv6 13279 1 ip6table_nat
nf_nat_irc 12723 0
nf_nat_pptp 13115 0
nf_nat_proto_gre 13009 1 nf_nat_pptp
nf_nat_sip 17186 0
nf_nat_snmp_basic 17302 0
nf_nat_tftp 12489 0
xt_addrtype 12635 5
xt_AUDIT 12678 0
xt_CHECKSUM 12549 0
xt_CLASSIFY 12507 0
xt_comment 12504 26
xt_connlimit 12917 0
xt_connmark 12755 0
xt_conntrack 12760 25
xt_CT 12956 32
xt_dccp 12606 0
xt_dscp 12597 0
xt_DSCP 12629 0
xt_hashlimit 17618 0
xt_helper 12583 0
xt_iprange 12783 0
xt_length 12536 0
xt_limit 12711 3
xt_LOG 17718 13
xt_mac 12492 0
xt_mark 12563 1
xt_multiport 12798 12
xt_nat 12681 3
xt_NFLOG 12537 0
xt_NFQUEUE 12697 0
xt_owner 12534 0
xt_physdev 12587 0
xt_pkttype 12504 0
xt_policy 12582 0
xt_realm 12498 0
xt_recent 18498 1
xt_sctp 12853 0
xt_set 13181 20
xt_state 12578 0
xt_statistic 12601 0
xt_tcpmss 12501 0
xt_TCPMSS 12664 1
xt_tcpudp 12884 47
xt_time 12661 0
xt_TPROXY 17356 0
Shorewall Lite has detected the following iptables/netfilter
capabilities:
ACCOUNT Target (ACCOUNT_TARGET): Not available
Address Type Match (ADDRTYPE): Available
Amanda Helper: Available
Arptables JF: Not available
AUDIT Target (AUDIT_TARGET): Available
Basic Ematch (BASIC_EMATCH): Available
Basic Filter (BASIC_FILTER): Available
Capabilities Version (CAPVERSION): 40600
Checksum Target: Available
CLASSIFY Target (CLASSIFY_TARGET): Available
Comments (COMMENTS): Available
Condition Match (CONDITION_MATCH): Not available
Connection Tracking Match (CONNTRACK_MATCH): Available
Connlimit Match (CONNLIMIT_MATCH): Available
Connmark Match (CONNMARK_MATCH): Available
CONNMARK Target (CONNMARK): Available
CT Target (CT_TARGET): Available
DSCP Match (DSCP_MATCH): Available
DSCP Target (DSCP_TARGET): Available
Enhanced Multi-port Match (EMULIPORT): Available
Extended Connection Tracking Match Support (NEW_CONNTRACK_MATCH):
Available
Extended Connmark Match (XCONNMARK_MATCH): Available
Extended CONNMARK Target (XCONNMARK): Available
Extended MARK Target 2 (EXMARK): Available
Extended MARK Target (XMARK): Available
Extended Multi-port Match (XMULIPORT): Available
Extended REJECT (ENHANCED_REJECT): Available
FLOW Classifier (FLOW_FILTER): Available
FTP-0 Helper: Not available
FTP Helper: Available
fwmark route mask (FWMARK_RT_MASK): Available
Geo IP match: Not available
Goto Support (GOTO_TARGET): Available
H323 Helper: Available
Hashlimit Match (HASHLIMIT_MATCH): Available
Header Match (HEADER_MATCH): Not available
Helper Match (HELPER_MATCH): Available
IMQ Target (IMQ_TARGET): Not available
IPMARK Target (IPMARK_TARGET): Not available
IPP2P Match (IPP2P_MATCH): Not available
IP range Match(IPRANGE_MATCH): Available
Ipset Match Counters (IPSET_MATCH_COUNTERS): Available
Ipset Match (IPSET_MATCH): Available
Ipset Match Nomatch (IPSET_MATCH_NOMATCH): Available
ipset V5 (IPSET_V5): Available
iptables -S (IPTABLES_S): Available
IRC-0 Helper: Not available
IRC Helper: Available
Kernel Version (KERNELVERSION): 31506
LOGMARK Target (LOGMARK_TARGET): Not available
LOG Target (LOG_TARGET): Available
Mangle FORWARD Chain (MANGLE_FORWARD): Available
Mark in the filter table (MARK_ANYWHERE): Available
MARK Target (MARK): Available
MASQUERADE Target: Available
Multi-port Match (MULTIPORT): Available
NAT (NAT_ENABLED): Available
Netbios_ns Helper: Available
New tos Match: Available
NFAcct match: Not available
NFLOG Target (NFLOG_TARGET): Available
NFQUEUE Target (NFQUEUE_TARGET): Available
Owner Match (OWNER_MATCH): Available
Owner Name Match (OWNER_NAME_MATCH): Available
Packet length Match (LENGTH_MATCH): Available
Packet Mangling (MANGLE_ENABLED): Available
Packet Type Match (USEPKTTYPE): Available
Persistent SNAT (PERSISTENT_SNAT): Available
Physdev-is-bridged Support (PHYSDEV_BRIDGE): Available
Physdev Match (PHYSDEV_MATCH): Available
Policy Match (POLICY_MATCH): Available
PPTP Helper: Available
Rawpost Table (RAWPOST_TABLE): Not available
Raw Table (RAW_TABLE): Available
Realm Match (REALM_MATCH): Available
Recent Match "--reap" option (REAP_OPTION): Available
Recent Match (RECENT_MATCH): Available
Repeat match (KLUDGEFREE): Available
RPFilter match: Available
SANE-0 Helper: Not available
SANE Helper: Available
SIP-0 Helper: Not available
SIP Helper: Available
SNMP Helper: Available
Statistic Match (STATISTIC_MATCH): Available
TCPMSS Match (TCPMSS_MATCH): Available
TFTP-0 Helper: Not available
TFTP Helper: Available
Time Match (TIME_MATCH): Available
TPROXY Target (TPROXY_TARGET): Available
UDPLITE Port Redirection: Not available
ULOG Target (ULOG_TARGET): Available
Netid State Recv-Q Send-Q Local Address:Port Peer
Address:Port
udp UNCONN 0 0 C.C.C.C:1194
*:* users:(("openvpn",pid=5548,fd=5))
tcp LISTEN 0 128 127.0.0.1:6010
*:* users:(("sshd",pid=19274,fd=7))
tcp LISTEN 0 128 127.0.0.1:6011
*:* users:(("sshd",pid=15396,fd=7))
tcp LISTEN 0 128 127.0.0.1:6012
*:* users:(("sshd",pid=16873,fd=7))
tcp LISTEN 0 128 127.0.0.1:6013
*:* users:(("sshd",pid=19384,fd=7))
tcp LISTEN 0 1 127.0.0.1:1195
*:* users:(("openvpn",pid=5548,fd=3))
tcp LISTEN 0 128 192.168.1.1:22
*:* users:(("sshd",pid=4233,fd=5))
tcp LISTEN 0 128 127.0.0.1:22
*:* users:(("sshd",pid=4233,fd=4))
Traffic Control
Device eth0:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1
1 1 1 1 1 1
Sent 10042321 bytes 81471 pkt (dropped 0, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
Device eth1:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1
1 1 1 1 1 1
Sent 43907078 bytes 76677 pkt (dropped 0, overlimits 0 requeues 1)
backlog 0b 0p requeues 1
Device tun1:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1
1 1 1 1 1 1
Sent 1201 bytes 20 pkt (dropped 0, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
TC Filters
Device eth0:
Device eth1:
Device tun1:
------------------------------------------------------------------------------
Want fast and easy access to all the code in your enterprise? Index and
search up to 200,000 lines of code with a free copy of Black Duck
Code Sight - the same software that powers the world's largest code
search on Ohloh, the Black Duck Open Hub! Try it now.
http://p.sf.net/sfu/bds
_______________________________________________
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users
