Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using shorewall as the firewall and gateway for a production site. The site also has a couple of VPNs running into it that are hosted on a different server on the same site (in the protected zone).

My setup for the servers on the site (in the protected zone) is to have the shorewall gateway as their default gateway and when they need to access resources on the other side of a VPN tunnel then the gateway will route the traffic to the local VPN endpoint (after subjecting it to firewall rules, of course) - so the traffic basically goes in through to the protected zone interface and gets routed out through the same interface.

This setup works great when shorewall is turned off, but when shorewall is turned on it puts in a rule that blocks this traffic.

I'm trying to configure shorewall to allow this kind of traffic, but I can't figure out how to do this. Shorewall has a file called route_rules, so I've added a rule into it, like this:

eth1 main         1000

(eth1 is the interface name for the protected zone, is the network on the other size of the VPN, main is what the 'shorewall-route_rules' man page says you should put to let the routing table handle the routing and 1000 is the default priority according to said man page).

But this seems to have no effect on the the iptables rules at all, nor have I seen any other configuration change as a result of this rule - and obviously my traffic still gets blocked.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.