Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Smoothwall box set up as my main gateway at 192.168.65.1. I also have a Proxmox virtual server at 192.168.65.160 that I use to make outbound VPN connections. Since the Smoothwall box is the default gateway, I want to to set it to route all local 192.168.65.0/24 network traffic bound for VPN destinations (such as the 192.168.1.0/24 subnet) to the 192.168.65.160 address.

Smoothwall is configured with /proc/sys/net/ipv4/ip_forward set to 1. The routing table is set as follows (eth0 = RED interface):

$ ip route
192.168.65.0/24 dev eth1  proto kernel  scope link  src 192.168.65.1 
192.168.1.0/24 via 192.168.65.160 dev eth1 
x.x.x.x/xx dev eth0  proto kernel  scope link  src x.x.x.x 
default via x.x.x.x dev eth0

If I ping a VPN address from the Smoothwall box, it works. However, when I try to ping a VPN address from any other host on the local 192.168.65.0/24 subnet, I get a "Destination Port Unreachable" result. If I set a route on the local host to send VPN traffic directly to the 192.168.65.160 gateway, that works. It's only when I try to route VPN traffic through the Smoothwall box that it doesn't get through.

What's going on?

share|improve this question
add comment

3 Answers

up vote 1 down vote accepted

ok, let's begin by just covering the basics... looks like smoothwall may be the issue here...

type the following on the console of your smoothwall and see if this fixes your issue:

iptables -I FORWARD 1 -s 192.168.65.0/24 -i eth1 -d 192.168.1.0/24 -j ACCEPT

please note this is a temporary fix to test if the issue is with smoothwall. if that works, then just add a rule on smoothwall to allow that traffic or add this line to something like rc.local (probably not the best idea... :) )

share|improve this answer
    
That did it! I also added that line to /etc/rc.d/rc.local, and it worked fine after a reboot. Thanks! –  Brian Showalter Nov 16 '10 at 13:22
add comment

You need to setup SNAT for that setup to work.

iptables -t nat -I POSTROUTING -o eth1 -d 192.168.1.0/24 -j SNAT --to-source 192.168.65.1

What is happening now is traffic from your lan comes to the firewall and is sent to the promox server which sends it to the destination when the other side responds the promox server sends it to the actual lan host when sent the initial packet but that host rejects it because it expects the reply from the smoothwall box

share|improve this answer
    
That didn't help. I still get the "Destination Port Unreachable" result. Also, running tcpdump on the Proxmox VM shows no traffic from the Smoothwall box coming in when I ping from a local host, but it does show traffic when I ping from Smoothwall. –  Brian Showalter Nov 15 '10 at 16:17
add comment

It seems like your configuration should work. I don't think NAT is what you need here.

Just a thought: Is it possible that Smoothwall refuses to forward packets that attempt to exit it via the same network interface that they entered from (in this case, eth1)? Such traffic might be considered abnormal or suspicious under typical cicumstances, and Smoothwall might be set up to block it on those grounds. Getting "Destination Port Unreachable" messages from ping indicates that you are getting ICMP error messages, which I suspect are being generated by Smoothwall as it rejects those packets.

Does Smoothwall provide logging facilities? If so, you should check the logs to see if my theory holds water.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.