Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a pptpd server and Shorewall running on the same server. The server has two ethernet connections (eth0 -> WAN, eth1 -> LAN) and its IP on the LAN is

I can establish a VPN-tunnel from my home computer with no problems, but I can't access any computers on the office LAN, including the VPN-server. If I ping the other end of the VPN-tunnel ( i get "Destination Host Unreachable".

But if I turn off Shorewall everything works!

Have I done something wrong with my shorewall configuration?


wan eth0 detect dhcp,routefilter,tcpflags
lan eth1 detect dhcp
vpn ppp+ 


fw firewall
wan ipv4
lan ipv4
vpn ipv4


eth0 eth1


vpn lan ACCEPT
lan vpn ACCEPT
wan all DROP
lan all REJECT
fw all ACCEPT
all all REJECT


pptpserver wan


I have this solved by now, but I'm not sure why I have to do this. Anyway, the solution was to add another policy:

vpn all ACCEPT

I thought that to Shorewall the VPN ppp0 interface would be a networking interface as any other, but it seems to know that the ppp0 traffic goes through eth0, and won't let it unless I add this policy. Is this correct?

share|improve this question
up vote 0 down vote accepted

You did not mention your rules file. Have you added appropriate entries to the rules file to allow TCP port 1723 and GRE (IP protocol 47) traffic to your pptp server? See this page for details.

Response to Update

Try replacing vpn all ACCEPT with the equivalent set of policies

vpn fw  ACCEPT
vpn wan ACCEPT
vpn lan ACCEPT

and test whether everything still works. If so, next try removing each of those policies one by one, testing whether everything still works each time, to get down to the minimal set of policies required. Is it possible that the only policy you really need to add is vpn wan ACCEPT ?

share|improve this answer
i have an extensive rules file, so i did not include it. Yes, I've added those, and I have a working connection. It's just that I can't access any hosts on the office-lan. As a matter of fact, I've solved it now. See edit above. – Jonatan Nov 13 '10 at 9:49
Glad to hear things are working now. I have updated my answer with a possible optimization for your policy set. – Steven Monday Nov 13 '10 at 20:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.