I have a Smoothwall box set up as my main gateway at I also have a Proxmox virtual server at that I use to make outbound VPN connections. Since the Smoothwall box is the default gateway, I want to to set it to route all local network traffic bound for VPN destinations (such as the subnet) to the address.

Smoothwall is configured with /proc/sys/net/ipv4/ip_forward set to 1. The routing table is set as follows (eth0 = RED interface):

$ ip route dev eth1  proto kernel  scope link  src via dev eth1 
x.x.x.x/xx dev eth0  proto kernel  scope link  src x.x.x.x 
default via x.x.x.x dev eth0

If I ping a VPN address from the Smoothwall box, it works. However, when I try to ping a VPN address from any other host on the local subnet, I get a "Destination Port Unreachable" result. If I set a route on the local host to send VPN traffic directly to the gateway, that works. It's only when I try to route VPN traffic through the Smoothwall box that it doesn't get through.

What's going on?


ok, let's begin by just covering the basics... looks like smoothwall may be the issue here...

type the following on the console of your smoothwall and see if this fixes your issue:

iptables -I FORWARD 1 -s -i eth1 -d -j ACCEPT

please note this is a temporary fix to test if the issue is with smoothwall. if that works, then just add a rule on smoothwall to allow that traffic or add this line to something like rc.local (probably not the best idea... :) )

  • That did it! I also added that line to /etc/rc.d/rc.local, and it worked fine after a reboot. Thanks! – Brian Showalter Nov 16 '10 at 13:22

You need to setup SNAT for that setup to work.

iptables -t nat -I POSTROUTING -o eth1 -d -j SNAT --to-source

What is happening now is traffic from your lan comes to the firewall and is sent to the promox server which sends it to the destination when the other side responds the promox server sends it to the actual lan host when sent the initial packet but that host rejects it because it expects the reply from the smoothwall box

  • That didn't help. I still get the "Destination Port Unreachable" result. Also, running tcpdump on the Proxmox VM shows no traffic from the Smoothwall box coming in when I ping from a local host, but it does show traffic when I ping from Smoothwall. – Brian Showalter Nov 15 '10 at 16:17

It seems like your configuration should work. I don't think NAT is what you need here.

Just a thought: Is it possible that Smoothwall refuses to forward packets that attempt to exit it via the same network interface that they entered from (in this case, eth1)? Such traffic might be considered abnormal or suspicious under typical cicumstances, and Smoothwall might be set up to block it on those grounds. Getting "Destination Port Unreachable" messages from ping indicates that you are getting ICMP error messages, which I suspect are being generated by Smoothwall as it rejects those packets.

Does Smoothwall provide logging facilities? If so, you should check the logs to see if my theory holds water.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.