On Tuesday 10 February 2004 10:17 am, Stephen Lee wrote: > Hi, > > I'm running a Bering1.2/CD system with a lan(eth1) and a proxy > dmz(eth2). There's workstation on the lan running a pcAnywhere host and > a server in the DMZ running pcAnywhere as well. I can connect to the lan > pcAnywhere via the public IP on eth0. The problem is that attempting to > connect to the DMZ pcAnywhere server (via it's public IP) results in a > connection to the lan workstation. Here are snippets of shorewall > settings: > > /etc/shorewall/interfaces: > #ZONE INTERFACE BROADCAST OPTIONS > net eth0 detect dhcp,routefilter,norfc1918 > loc eth1 detect dhcp > dmz eth2 detect > > /etc/shorewall/policy: > #SOURCE DEST POLICY LOG LEVEL LIMIT:BURST > loc net ACCEPT > dmz net ACCEPT > net all DROP ULOG > all all REJECT ULOG > > /etc/shorewall/rules: > DNAT net loc:192.168.1.238 tcp 5631 > DNAT net loc:192.168.1.238 udp 5632
Since you: a) Haven't specified an ORIGINAL DESTINATION; and B) Apparently have DETECT_DNAT_ADDRS=No in shorewall.conf then the above rules will apply to any PCanywhere traffic from the NET regardless of destination. -Tom -- Tom Eastep \ Nothing is foolproof to a sufficiently talented fool Shoreline, \ http://shorewall.net Washington USA \ [EMAIL PROTECTED] ------------------------------------------------------- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn ------------------------------------------------------------------------ leaf-user mailing list: [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user SR FAQ: http://leaf-project.org/pub/doc/docmanager/docid_1891.html
