I have this scenario and everything it's working OK, but I want to configure my Shorewall and I can't do it.

My interfaces are:

br0 (bridge of eth0)
tun0 (OpenVPN)
vnet* (each one of bridged interfaces with public IP's)

Public Main IP: 188.165.X.Y
OpenVPN IP's: 172.28.0.x
Bridge: public ip's

So, I have the next configuration for shorewall:


#ZONE   TYPE        OPTIONS     IN          OUT
#                               OPTIONS     OPTIONS
fw      firewall
inet    ipv4
road    ipv4


inet    br0         detect          routeback
road    tun+        detect          routeback


#               LEVEL   BURST       MASK
$FW  all     ACCEPT
inet    $FW  DROP       info
road    all     DROP
inet    road    DROP


#TYPE           ZONE        GATEWAY     GATEWAY
#                                       ZONE
openvpnserver:1194          inet

The problem is that even with shorewall running I am able to ping or connect to the virtual machines behind the bridge


You shouldn't be firewalling interfaces which are members of a bridge, only the bridge interface itself. A bridge is a layer 2 domain, whereas iptables is a layer 3 firewall, so it only works when the host is routing packets at layer 3.

In your case Shorewall should only know about br0 and tun+, since eth0 and vnet+ are members of br0. If you want to police traffic between the VMs and the Internet then you must change your configuration to not bridge the VMs onto the LAN (i.e. take eth0 out of br0).

  • 1
    So your proposal is to remove eth0 and vnet+ from interfaces and set br0 to inet zone? – blacksoul Jun 28 '12 at 23:15
  • @JavierMartinez Correct. – mgorven Jun 28 '12 at 23:24
  • Ok, I did it and now I have access to Internet from OpenVPN and from virtual machines of the bridge. The point is that, with my policy rules, I won't be able to ping or connect to the bridge public ip's and however I can – blacksoul Jun 29 '12 at 8:06
  • i have just updated the question with your configuration changes and the problem now – blacksoul Jun 29 '12 at 10:47
  • @JavierMartinez As I said in my answer, if you want to control the traffic between the LAN and the VMs you need to not bridge them onto the LAN and route the traffic instead. – mgorven Jun 29 '12 at 16:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.