Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

edit3:

i would like to get exactly what is descripted in http://shorewall.net/FAQ.htm#faq1g but it doesn't work for me.

edit3 end;

os: debian squeeze shorwall: 4.4.11.6-3

3 computers a, b & c; shorewall is on computer b i would like to dnat port 8140 from b->c, so computer a can connect to b and will be dnated to c followed the faq 1g (thanks go out to omache) http://www.shorewall.net/FAQ.htm#faq1g. rules, interfaces, masq set according the faq

the direct connections work:

a->b   a->b->b(temp rule: DNAT:debug   net   fw:ip.of.computer.b:80   tcp   8140   -   -)
b->c   
a->c 

regular shorwall rules on computer b:

DNAT:debug   net   net:ip.of.computer.c:8140   tcp   8140   -   ip.of.computer.b
DNAT:debug   $FW   net:ip.of.computer.c:8140   tcp   8140   -   ip.of.computer.b

so dnating should work. according the faqs i debugged the dnat. package count increases.

is the problem the http://www.shorewall.net/FAQ.htm#faq1a "dropping the outbound SYN,ACK response." how to debug this? shouldn't then also the b->c and a->c direct connections be a problem or do they work without syn,ack

a->b->c    does not work
b->b->c    does work

log entry from the a->b->c connection

Oct 11 03:34:03 servername kernel: [3457359.671611] Shorewall:net_dnat:DNAT:IN=eth0 OUT= MAC=-SNIP- SRC=ip.of.computer.a DST=ip.of.computer.b LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=49585 DF PROTO=TCP SPT=60499 DPT=8140 WINDOW=5840 RES=0x00 SYN URGP=0

edit1:

made more debugging tests, thanks go again to omache.

tcpdump 'ip host A or B or C and not (port ssh or http or smtp or pop3)' tcpdump 'ip host A or B or D and not (port ssh or smtp or pop3)'

A->B->C (dnat): shows incomming traffic but nothing goes out to C B->B->C (local dnat): works and traffic is shown going to C

it is not the syn, ack problem, i made a test with a forth host D and exchanged C with D, D is a server which is able to reply ACK and SYN

i double checked the faq info, this is the content of my affected files:

rule

DNAT:debug   net     net:$HOST_IP_D:80 tcp  8140 -  $HOST_IP_B

interfaces

net     eth0    detect   tcpflags,logmartians,nosmurfs,routeback

masq

eth0:$HOST_IP_D  0.0.0.0/0   $HOST_IP_B  tcp          80
share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

the shorewall mailinglist helped (thanks go out to tom)

shorwall.conf

IP_FORWARDING=On
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.