Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


i would like to get exactly what is descripted in but it doesn't work for me.

edit3 end;

os: debian squeeze shorwall:

3 computers a, b & c; shorewall is on computer b i would like to dnat port 8140 from b->c, so computer a can connect to b and will be dnated to c followed the faq 1g (thanks go out to omache) rules, interfaces, masq set according the faq

the direct connections work:

a->b   a->b->b(temp rule: DNAT:debug   net   tcp   8140   -   -)

regular shorwall rules on computer b:

DNAT:debug   net   tcp   8140   -
DNAT:debug   $FW   tcp   8140   -

so dnating should work. according the faqs i debugged the dnat. package count increases.

is the problem the "dropping the outbound SYN,ACK response." how to debug this? shouldn't then also the b->c and a->c direct connections be a problem or do they work without syn,ack

a->b->c    does not work
b->b->c    does work

log entry from the a->b->c connection

Oct 11 03:34:03 servername kernel: [3457359.671611] Shorewall:net_dnat:DNAT:IN=eth0 OUT= MAC=-SNIP- LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=49585 DF PROTO=TCP SPT=60499 DPT=8140 WINDOW=5840 RES=0x00 SYN URGP=0


made more debugging tests, thanks go again to omache.

tcpdump 'ip host A or B or C and not (port ssh or http or smtp or pop3)' tcpdump 'ip host A or B or D and not (port ssh or smtp or pop3)'

A->B->C (dnat): shows incomming traffic but nothing goes out to C B->B->C (local dnat): works and traffic is shown going to C

it is not the syn, ack problem, i made a test with a forth host D and exchanged C with D, D is a server which is able to reply ACK and SYN

i double checked the faq info, this is the content of my affected files:


DNAT:debug   net     net:$HOST_IP_D:80 tcp  8140 -  $HOST_IP_B


net     eth0    detect   tcpflags,logmartians,nosmurfs,routeback


eth0:$HOST_IP_D   $HOST_IP_B  tcp          80
share|improve this question
up vote 0 down vote accepted

the shorewall mailinglist helped (thanks go out to tom)


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.