On 5/11/2015 4:42 PM, Mike Walker wrote: > Machine in question is Debian 5 running 2.6.26-2-amd64. > Shorewall version is 4.0.15 > IPSec Tools version is 1:0.7.1-1.3+lenny2 > Racoon version is 1:0.7.1-1.3+lenny2 > > This system is making an IPSec connection with a Watchguard firewall. > If I set a Shorewall policy of "all all ACCEPT" I can pass traffic in > both directions through the tunnel. However, with my current > configuration I am able to get traffic to pass from the Watchguard side, > but any traffic I try to pass through it ends up Host Unreachable with > this line in the Shorewall log... > > May 11 03:08:40 iqonline-gw kernel: [63836226.948493] > Shorewall:FORWARD:REJECT:IN=eth0.10 OUT=eth1 SRC=10.128.3.3 > DST=192.168.4.99 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=ICMP > TYPE=8 CODE=0 ID=20461 SEQ=1834 MARK=0x5 > > I'm running OpenVPN on the vpn zone, and IPSEC on the sec zone. > > My subnet here: 10.128.0.0/9 > Watchguard subnet: 192.168.0.0/21 > v10 is basically my internal and ext all all my external vlans. > > HOSTS: > sec eth1:10.128.0.0/9
This entry should have 192.168.0.0/21, not your local net > vpn eth1:10.128.0.0/9 That entry can't be right -- Given that your interfaces file has an entry for vpn with tun+, I think this entry is superfluous. > > INTERFACES: > net eth1 detect routefilter,norfc1918,blacklist > v10 eth0.10 detect routeback > ext eth0.76 detect routeback > ext eth0.230 detect > ext eth0.231 detect > ext eth0.232 detect > vpn tun+ > > MASQ: > eth1 eth0.10 > > POLICY: > fw all ACCEPT > v10 all ACCEPT > ext all ACCEPT > sec all ACCEPT > vpn all ACCEPT > net all DROP 6 > all all REJECT 6 > > RULES: > ACCEPT net:192.168.0.0/21 all > > TUNNELS: > openvpnserver:1194 net 0.0.0.0/0 <http://0.0.0.0/0> > ipsec net 0.0.0.0/0 <http://0.0.0.0/0> > > ZONES: > fw firewall > sec ipsec # I've tried ipv4 here and ipsec in HOSTS > v10 ipv4 > net ipv4 > ext ipv4 > vpn ipv4 > > > Any help would be greatly appreciated, as I've been beating on this for > days and Googled myself to insanity. I've stripped my config down to > the bare minimum to eliminate errors but I just can't get her to budge. > Thank you!!! > > -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ One dashboard for servers and applications across Physical-Virtual-Cloud Widest out-of-the-box monitoring support with 50+ applications Performance metrics, stats and reports that give you Actionable Insights Deep dive visibility with transaction tracing using APM Insight. http://ad.doubleclick.net/ddm/clk/290420510;117567292;y
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
