I have a ipsec tunnel working that gives access to a 192.168.4.0/24 lan. It is working fine and I can access hosts on the other side without problem:
# from fw and lan hosts:
# ping 192.168.4.44
PING 192.168.4.44 (192.168.4.44) 56(84) bytes of data.
64 bytes from 192.168.4.44: icmp_req=1 ttl=127 time=4.41 ms
but when I try to forward a port on shorewall from the public IP address to a host on the other side of the tunnel, it doesn't routes the traffic:
# from wan side:
# telnet x.x.x.x 33901
telnet: Unable to connect to remote host: No route to host
tcpdump capture on firewall for IP doing the telnet (wan):
# tcpdump -n -i eth0.20 host 37.15.173.52
10:09:48.312840 IP [fw_public_ip] > 37.15.173.52: ICMP host [fw_public_ip] unreachable, length 68
why shorewall is routing correctly traffic from fw and lan side but not from wan?
---- shorewall config ----
relevant routes entries:
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL
# PORT PORT(S) DEST
DNAT:info wan vpn:192.168.4.44:3389 tcp 33901 - [fw_public_ip]
relevant zones entries:
#ZONE TYPE
wan ipv4
vpn ipv4
relevant hosts entries:
#ZONE HOSTS OPTIONS
vpn eth0.20:192.168.4.0/24,[ipsec_host_ip] ipsec
relevant tunnels entries:
#TYPE ZONE GATEWAY GATEWAY ZONE
ipsec wan [ipsec_host_ip]
relevant interfaces entries:
#ZONE INTERFACE BROADCAST OPTIONS
wan eth0.20 detect dhcp,routefilter
relevant masq entries:
#INTERFACE SOURCE ADDRESS PROTO PORT(S) IPSEC MARK
eth0.20 0.0.0.0/0 [fw_public_ip]
