I have a Shorewall powered masquerading router:
- eth0: DHCP client, external interface (
- eth1: static, internal interface (
Now I want to add an OpenVPN client that creates a TUN device when the connection is up:
tun1, and I want to route all traffic destined for the subnet 18.104.22.168/24 to go through the VPN tunnel. All other traffic should go out through eth0 as before.
If the VPN connection is down (and the TUN device does not exist), traffic to that subnet should go through eth0 as well, as a fallback.
It seems like my
/etc/shorewall/routes are being ignored entirely, as all traffic still goes out through eth0.
What am I doing wrong?
Here's my shorewall configuration in a nutshell:
#ZONE TYPE OPTIONS IN OUT # OPTIONS OPTIONS fw firewall net ipv4 loc ipv4 tun ipv4 # tunnels for outgoing traffic
#ZONE INTERFACE BROADCAST OPTIONS net eth0 detect loc eth1 detect tun tun1 - optional
#NAME NUMBER MARK DUPLICATE INTERFACE GATEWAY OPTIONS COPY ISP 1 1 main eth0 detect fallback TUN 2 2 - tun1 detect
#PROVIDER DEST GATEWAY DEVICE #specifying default route causes error, so it's commented out: # ERROR: Command "ip -4 route add 0.0.0.0/0 dev eth0 table 1" Failed #ISP 0.0.0.0/0 # THIS ROW has no effect TUN 22.214.171.124/24
#INTERFACE:DEST SOURCE ADDRESS PROTO PORT(S) IPSEC MARK USER/ SWITCH ORIGINAL # GROUP DEST # masqueraded LAN subnet is 10.0.0.0/24 eth0 10.0.0.0/24 tun1 10.0.0.0/24
The result of the command
shorewall show routing is pasted here