10.10.10.1 is in the fw ($FW) zone, not the loc zone and your road->fw policy
is REJECT. This is abundantly clear just looking at the log:
Thank you.
So how could I safely 'open' services behind fw (in the fw zone) for
OpenVPN' roadwarriors?
Will the insertion of this row:
road $FW ACCEPT
to the /etc/shorewall/policy be sufficient and safe?
See my current /etc/shorewall/policy file:
#SOURCE DEST POLICY LOG LEVEL LIMIT:BURST
loc net ACCEPT
loc $FW ACCEPT
$FW net ACCEPT
$FW loc ACCEPT
road loc ACCEPT
loc road ACCEPT
net all DROP info
all all REJECT info
Regards,
B
W dniu 2018-02-08 o 19:19, Tom Eastep pisze:
On 02/08/2018 10:10 AM, Bernard Drozd wrote:
Okay -- please collect and forward the output of 'shorewall dump' as described
at http://www.shorewall/support.htm#Guidelines.
Please find attached shorewall_dump output catched when I tried to
connect to the local website on my server 10.10.10.1 and
10.10.10.1:5001 from the LTE mobile device 10.8.0.6 using openvpn.
10.10.10.1 is in the fw ($FW) zone, not the loc zone and your road->fw
policy is REJECT. This is abundantly clear just looking at the log:
Feb 8 18:59:14 road-fw:REJECT:IN=tun0 OUT= SRC=10.8.0.6 DST=10.10.10.1
LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=13369 DF PROTO=TCP SPT=60280
DPT=5001 WINDOW=14600 RES=0x00 SYN URGP=0
Feb 8 18:59:15 road-fw:REJECT:IN=tun0 OUT= SRC=10.8.0.6 DST=10.10.10.1
LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=17443 DF PROTO=TCP SPT=45060
DPT=5001 WINDOW=14600 RES=0x00 SYN URGP=0
-Tom
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users
