3

I have a Smoothwall box set up as my main gateway at 192.168.65.1. I also have a Proxmox virtual server at 192.168.65.160 that I use to make outbound VPN connections. Since the Smoothwall box is the default gateway, I want to to set it to route all local 192.168.65.0/24 network traffic bound for VPN destinations (such as the 192.168.1.0/24 subnet) to the 192.168.65.160 address.

Smoothwall is configured with /proc/sys/net/ipv4/ip_forward set to 1. The routing table is set as follows (eth0 = RED interface):

$ ip route
192.168.65.0/24 dev eth1  proto kernel  scope link  src 192.168.65.1 
192.168.1.0/24 via 192.168.65.160 dev eth1 
x.x.x.x/xx dev eth0  proto kernel  scope link  src x.x.x.x 
default via x.x.x.x dev eth0

If I ping a VPN address from the Smoothwall box, it works. However, when I try to ping a VPN address from any other host on the local 192.168.65.0/24 subnet, I get a "Destination Port Unreachable" result. If I set a route on the local host to send VPN traffic directly to the 192.168.65.160 gateway, that works. It's only when I try to route VPN traffic through the Smoothwall box that it doesn't get through.

What's going on?

Improve this question

3 Answers 3

Reset to default
3

ok, let's begin by just covering the basics... looks like smoothwall may be the issue here...

type the following on the console of your smoothwall and see if this fixes your issue:

iptables -I FORWARD 1 -s 192.168.65.0/24 -i eth1 -d 192.168.1.0/24 -j ACCEPT

please note this is a temporary fix to test if the issue is with smoothwall. if that works, then just add a rule on smoothwall to allow that traffic or add this line to something like rc.local (probably not the best idea... :) )

Improve this answer
1
  • That did it! I also added that line to /etc/rc.d/rc.local, and it worked fine after a reboot. Thanks!
    – Brian Showalter
    Nov 16, 2010 at 13:22
2

You need to setup SNAT for that setup to work.

iptables -t nat -I POSTROUTING -o eth1 -d 192.168.1.0/24 -j SNAT --to-source 192.168.65.1

What is happening now is traffic from your lan comes to the firewall and is sent to the promox server which sends it to the destination when the other side responds the promox server sends it to the actual lan host when sent the initial packet but that host rejects it because it expects the reply from the smoothwall box

Improve this answer
1
  • That didn't help. I still get the "Destination Port Unreachable" result. Also, running tcpdump on the Proxmox VM shows no traffic from the Smoothwall box coming in when I ping from a local host, but it does show traffic when I ping from Smoothwall.
    – Brian Showalter
    Nov 15, 2010 at 16:17
0

It seems like your configuration should work. I don't think NAT is what you need here.

Just a thought: Is it possible that Smoothwall refuses to forward packets that attempt to exit it via the same network interface that they entered from (in this case, eth1)? Such traffic might be considered abnormal or suspicious under typical cicumstances, and Smoothwall might be set up to block it on those grounds. Getting "Destination Port Unreachable" messages from ping indicates that you are getting ICMP error messages, which I suspect are being generated by Smoothwall as it rejects those packets.

Does Smoothwall provide logging facilities? If so, you should check the logs to see if my theory holds water.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .