-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
On 12/15/2016 12:34 PM, Tom Eastep wrote:
>
> But before you do that, try placing only
>
> proto=esp
>
> in the OPTIONS column of the vpn1 zone file entry.
>
I have put together a test bed of my own and have been able to
reproduce the problem. Using standard Shorewall configuration methods,
I am unable to pass the IPIP packets.
I have a workaround, however. I created /etc/shorewall/start and added
the following command:
run_iptables -A eth0_in -s 10.2.10.2 -p 4 -j ACCEPT
where 10.2.10.2 is the remote IPSEC gateway. I then placed this in the
OPTIONS column of vpn1's entry in the zones file:
proto=esp,mode=transport
I will continue to work on this to come up with a cleaner solution.
Regards,
- -Tom
- --
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: GPGTools - http://gpgtools.org
iQIcBAEBCAAGBQJYVHOhAAoJEJbms/JCOk0QFMkP+wctN+N3efGuCeDxhv78l2U2
bkfdw9f3zobl4amwOqeWjK9e4ss9J6VO44k2VfOpjI0oJDO2v+7GN7nBiHkukZSP
3pmwzqtbU8xsApgM38Zm673Yz4QbrO7GA7FwNe0UlB+vVYWjRMVOB1dthH8bEfEY
6rC+d43SIyIg6+7EycXBMMrxjChIe3QRJckPf69BtG9cmd5QhFdulPB9BJiY+AEV
MuSPd1np7XoSZonIbUfaRaOWvSBCHMyZThVTK6Ba4MVhP0bPvuQckvEUyZ4bzJAy
xjACEOToHK6Db+a+Pbw1vTbVEnKdoVKowliodd8IsAxeIDFLr023uXThIAQbnX89
IOla6S/nEzGG+fil7mgjntvgSa5Fj/0nxAGbvLKVGYh+ybjDhkvtqg6pVfB465wE
z4/38zvm8Ru7atB35hmuUbPvNla8ChrsGjPy+O5oBxnymSVlvKsev8Gyf7cRl72S
I25BzPXMcAqIED6RGe2a70fVopFAw/1MUoP9feFOfN3NxSBlFBbxfP6lfrp4C5+O
iJx6iv+Mj9/WgxzAC6ecDbG5bQT9A+8kwMqn8qaImOsEotupAnob5maasRAZcyOA
0pHgGnv47oVTP+GJTpFBppmgSjqReg7IpObXcFhbmhvUVNY4XI6jRc2kcLyypcsB
QKDbnCM4Sk8TY6NAM1sU
=Pi5l
-----END PGP SIGNATURE-----
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
