On 3/17/13 9:46 AM, "TJ" <[email protected]> wrote: > >$ sudo tcpdump -ni tun0 port 80 or tcp port 3128 >listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes >16:25:12.024613 IP 82.71.24.87.39176 > 91.189.92.201.80: Flags [S], seq >1971087366, win 14520, options [mss 1452,sackOK,TS val 168165226 ecr >0,nop,wscale 4], length 0 >16:25:13.023137 IP 82.71.24.87.39176 > 91.189.92.201.80: Flags [S], seq >1971087366, win 14520, options [mss 1452,sackOK,TS val 168165476 ecr >0,nop,wscale 4], length 0 > >Notice the source IP on tun0 is the IP of ppp0. This was why I added the >MASQ entry: > >/etc/shorewall/masq >#INTERFACE SOURCE ADDRESS PROTO PORT(S) IPSEC >MARK >ppp0 10.0.0.0/8,169.254.0.0/16,172.16.0.0/12,192.168.0.0/16 82.71.24.87 >#ppp1 10.0.0.0/8,169.254.0.0/16,172.16.0.0/12,192.168.0.0/16 82.71.24.87 >eth9 br0 >tun0 10.0.0.0/8,127.0.0.0/8 10.254.252.18 >#tun0 br0 >
That masq entry certainly won't change the SOURCE ip from 82.71.24.87 to 10.254.252.18. It only works for 10.0.0.0/8 in the SOURCE (you can't NAT 127.0.0.0/8 so that part of the rule is just extra noise). > -Tom You do not need a parachute to skydive. You only need a parachute to skydive twice. ------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_d2d_mar _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
