I'm setting up Shorewall (220.127.116.11), and have been trying to figure out routing between two LAN segments for the good part of the afternoon. It's time to ask for help.
((INTERNET)) | | [shorewall] | | | | (LAN1) (LAN2)
I have three NICs: WAN (Internet), LAN1, and LAN2. WAN-to-LAN is working inbound through NAT, and outbound through DNAT (set in masq). LAN2 should not (and currently does not) have access to the Internet, but it should be accessible from LAN1. I'm currently able to get to LAN2 from the firewall, but not from the servers in LAN1 (which is the problem). The necessary rules are in place, but apparently routing isn't working (when I disable the firewall rules, I get immediate "connection refused" on SSH connection from a server in LAN1; when the rules are enabled, SSH simply hangs and traceroute doesn't go beyond the firewall). LAN1 is in 18.104.22.168 address space and LAN2 is in 10.0.0.0 address space.
I currently have:
..in masq, but that's not working ($LAN2_IF resolves to eth2 which is the LAN2 interface).
My question is: What is the simplest Shorewall configuration to forward traffic between two differently addressed LAN segments that are connected to separate NICs? A pointer to documentation or other reference would help, a bare-bones config example would be even better. I've been sifting through the Shorewall documentation on routing, but haven't yet found a matching description (for instance, I would rather not have to bridge the LAN interfaces since they need to remain separated: LAN2 should not have access either to the Internet or LAN1).
Thanks for any advice!