I have a problem with my shorewall policy. There are 4 zones configured in shorewall but the policy vpn2vpn:accept doesn't work. I want to establish connections between PPTP clients. They are dropped when using the current policy.
However if I change the all2all policy at the end of the policy file to all2all:accept it works. I have no idea why as there are no zones missing in the policy file.
You can find the syslog entry which is generated by the last policy (all all DROP info) below.
Does someone knows what is missing in the policy file?
fw fw ACCEPT fw net ACCEPT fw dmz DROP fw vpn ACCEPT dmz dmz ACCEPT dmz net ACCEPT dmz fw ACCEPT dmz vpn ACCEPT net fw DROP net dmz DROP net vpn DROP vpn fw ACCEPT vpn dmz ACCEPT vpn vpn ACCEPT vpn net ACCEPT all all DROP info
fw firewall net ipv4 dmz ipv4 vpn ipv4
#ZONE INTERFACE BROADCAST OPTIONS net eth0 detect blacklist,nosmurfs dmz venet0 detect routeback dmz vmbr0 detect routeback vpn ppp+
Dec 5 12:39:48 W137 kernel: Shorewall:FORWARD:DROP:IN=ppp0 OUT=ppp1 SRC=192.168.210.100 DST=192.168.210.101 LEN=52 TOS=0x00 PREC=0x00 TTL=127 ID=5769 DF PROTO=TCP SPT=4307 DPT=3389 WINDOW=8192 RES=0x00 SYN URGP=0