0

I have a Shorewall powered masquerading router:

  • eth0: DHCP client, external interface (net zone)
  • eth1: static, internal interface (loc zone)

Now I want to add an OpenVPN client that creates a TUN device when the connection is up: tun1, and I want to route all traffic destined for the subnet 30.40.50.0/24 to go through the VPN tunnel. All other traffic should go out through eth0 as before.
If the VPN connection is down (and the TUN device does not exist), traffic to that subnet should go through eth0 as well, as a fallback.

It seems like my /etc/shorewall/routes are being ignored entirely, as all traffic still goes out through eth0.
What am I doing wrong?

Here's my shorewall configuration in a nutshell:

/etc/shorewall/zones:

#ZONE   TYPE    OPTIONS                 IN                      OUT
#                                       OPTIONS                 OPTIONS
fw      firewall
net     ipv4
loc     ipv4
tun     ipv4    # tunnels for outgoing traffic

/etc/shorewall/interfaces:

#ZONE   INTERFACE       BROADCAST       OPTIONS
net     eth0            detect          
loc     eth1            detect          
tun     tun1            -               optional

/etc/shorewall/providers:

#NAME   NUMBER  MARK    DUPLICATE       INTERFACE       GATEWAY         OPTIONS         COPY
ISP     1       1       main            eth0            detect          fallback
TUN     2       2       -               tun1            detect

/etc/shorewall/routes

#PROVIDER               DEST                    GATEWAY         DEVICE
#specifying default route causes error, so it's commented out:
#   ERROR: Command "ip -4 route add 0.0.0.0/0 dev eth0 table 1" Failed
#ISP                    0.0.0.0/0

# THIS ROW has no effect
TUN                     30.40.50.0/24

/etc/shorewall/masq:

#INTERFACE:DEST         SOURCE          ADDRESS         PROTO   PORT(S) IPSEC   MARK    USER/   SWITCH  ORIGINAL
#                                                                                       GROUP           DEST
# masqueraded LAN subnet is 10.0.0.0/24
eth0                    10.0.0.0/24
tun1                    10.0.0.0/24

The result of the command shorewall show routing is pasted here

  • Ummm... Why are you setting route-noexec in the client? This prevents the route from being pushed and relies on lots of additional configuration. – David Hoelzer Nov 1 '14 at 0:48
  • If I don't do that, i.e. if I leave the default settings, ALL traffic will be routes through the tunnel. I don't wamt that to happen – derabbink Nov 1 '14 at 23:34
  • Why do you have the TUN configured in providers? The providers files should be for connections to ISPs. I don't believe that should be there in your case. shorewall.net/manpages/shorewall-providers.html. Does link cover what you are trying to do? shorewall.net/OPENVPN.html – Kevin Hayashi Nov 2 '14 at 2:18
  • I have been working with the Shorewall docs, and I have studied both pages you mentioned. The VPN docs don't cover my situation where I want all outgoing (including masqueraded) traffic destined for a particular publicly routed subnet to go through the tunnel. The providers approach seemed the most suitable because my scenario involves two external interfaces that each need to handle part of the traffic. – derabbink Nov 2 '14 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.