Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a problem with my shorewall policy. There are 4 zones configured in shorewall but the policy vpn2vpn:accept doesn't work. I want to establish connections between PPTP clients. They are dropped when using the current policy.

However if I change the all2all policy at the end of the policy file to all2all:accept it works. I have no idea why as there are no zones missing in the policy file.

You can find the syslog entry which is generated by the last policy (all all DROP info) below.

Does someone knows what is missing in the policy file?

shorewall policy:

fw      fw      ACCEPT
fw      net     ACCEPT
fw      dmz     DROP
fw      vpn     ACCEPT

dmz     dmz     ACCEPT
dmz     net     ACCEPT
dmz     fw      ACCEPT
dmz     vpn     ACCEPT

net     fw      DROP
net     dmz     DROP
net     vpn     DROP

vpn     fw      ACCEPT
vpn     dmz     ACCEPT
vpn     vpn     ACCEPT
vpn     net     ACCEPT

all     all     DROP info

shorewall zones:

fw      firewall
net     ipv4
dmz     ipv4
vpn     ipv4

shorewall interfaces:

#ZONE   INTERFACE       BROADCAST       OPTIONS
net     eth0            detect          blacklist,nosmurfs
dmz     venet0          detect          routeback
dmz     vmbr0           detect          routeback
vpn     ppp+

syslog:

Dec  5 12:39:48 W137 kernel: Shorewall:FORWARD:DROP:IN=ppp0 OUT=ppp1 SRC=192.168.210.100 DST=192.168.210.101 LEN=52 TOS=0x00 PREC=0x00 TTL=127 ID=5769 DF PROTO=TCP SPT=4307 DPT=3389 WINDOW=8192 RES=0x00 SYN URGP=0
share|improve this question

1 Answer 1

up vote 1 down vote accepted

The definition for the VPN zone needs routeback. By default Shorewall isolates system on the same zone.

share|improve this answer
    
Thanks. Now it works :). –  Eliasdx Dec 6 '10 at 17:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.