I'm using shorewall as the firewall and gateway for a production site. The site also has a couple of VPNs running into it that are hosted on a different server on the same site (in the protected zone).
My setup for the servers on the site (in the protected zone) is to have the shorewall gateway as their default gateway and when they need to access resources on the other side of a VPN tunnel then the gateway will route the traffic to the local VPN endpoint (after subjecting it to firewall rules, of course) - so the traffic basically goes in through to the protected zone interface and gets routed out through the same interface.
This setup works great when shorewall is turned off, but when shorewall is turned on it puts in a rule that blocks this traffic.
I'm trying to configure shorewall to allow this kind of traffic, but I can't figure out how to do this. Shorewall has a file called route_rules, so I've added a rule into it, like this:
#SOURCE DEST PROVIDER PRIORITY eth1 192.168.1.0/24 main 1000
eth1 is the interface name for the protected zone,
192.168.1.0/24 is the network on the other size of the VPN,
main is what the 'shorewall-route_rules' man page says you should put to let the routing table handle the routing and
1000 is the default priority according to said man page).
But this seems to have no effect on the the iptables rules at all, nor have I seen any other configuration change as a result of this rule - and obviously my traffic still gets blocked.