> 1. The answer may already be in /var/log/messages.  That's how I've been able 
> to solve most of my problems - usually an unexpected port/message for which 
> there is no rule.  I debugged a problem with NFS between two machines on my 
> local lan in exactly this fashion.

I think the main culprit in my log thats causing the problem is :

Dec 25 18:43:19 [kernel] Shorewall:INPUT:REJECT:IN=eth0 OUT=
MAC=00:c0:4f:7c:6f:77:00:06:25:a2:44:f6:08:00
SRC=129.100.171.40 DST=192.168.1.2 LEN=60 TOS=0x10 PREC=0xA0 TTL=47
ID=57151 DF PROTO=TCP SPT=53118 DPT=22
WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0

>From reading the docs on shorewall.net, I understand the problem to be
the src ip not being in the net zone.

What's weird that I'm noticing, when I ssh from my notebook to the
server, a shorewall log entry doesn't exist? 

just thought I show whats in iptables:
# iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
DROP      !icmp --  anywhere             anywhere           state
INVALID
eth0_in    all  --  anywhere             anywhere
common     all  --  anywhere             anywhere
LOG        all  --  anywhere             anywhere           LOG level
info prefix `Shorewall:INPUT:REJECT:'
reject     all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination
DROP      !icmp --  anywhere             anywhere           state
INVALID
eth0_fwd   all  --  anywhere             anywhere
common     all  --  anywhere             anywhere
LOG        all  --  anywhere             anywhere           LOG level
info prefix `Shorewall:FORWARD:REJECT:'
reject     all  --  anywhere             anywhere

Chain OUTPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
DROP      !icmp --  anywhere             anywhere           state
INVALID
fw2net     all  --  anywhere             eigen.tomek.ca
fw2net     all  --  anywhere             192.168.1.3
fw2loc     all  --  anywhere             192.168.1.0/24
common     all  --  anywhere             anywhere
LOG        all  --  anywhere             anywhere           LOG level
info prefix `Shorewall:OUTPUT:REJECT:'
reject     all  --  anywhere             anywhere

Chain all2all (4 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere           state
RELATED,ESTABLISHED
newnotsyn  tcp  --  anywhere             anywhere           state NEW
tcp flags:!SYN,RST,ACK/SYN
common     all  --  anywhere             anywhere
LOG        all  --  anywhere             anywhere           LOG level
info prefix `Shorewall:all2all:REJECT:'
reject     all  --  anywhere             anywhere

Chain common (5 references)
target     prot opt source               destination
icmpdef    icmp --  anywhere             anywhere
reject     udp  --  anywhere             anywhere           udp
dpt:epmap
reject     udp  --  anywhere             anywhere           udp
dpts:netbios-ns:netbios-ssn
reject     udp  --  anywhere             anywhere           udp
dpt:microsoft-ds
reject     tcp  --  anywhere             anywhere           tcp
dpt:netbios-ssn
reject     tcp  --  anywhere             anywhere           tcp
dpt:microsoft-ds
reject     tcp  --  anywhere             anywhere           tcp
dpt:epmap
DROP       udp  --  anywhere             anywhere           udp dpt:1900

Tom


--
[EMAIL PROTECTED] mailing list

Reply via email to