I hope this is the correct list for these sorts of questions. I've
been googling for solutions for the past day or so and haven't found
anything. Also, someone posted to this list a few weeks ago with the
exact problem I'm having, but I couldn't seem to find whether or not
it had been solved. If I've missed it, or if you want to come forward
and tell me how you did it, I'd very much appreciate it.
Summary: I have a linux firewall behind which I have two vservers and
a number of desktop machines. I'm using Shorewall (http://
www.shorewall.net) for the iptables setup. Despite the fact that most
of my network works, I cannot connect to an SSH server which I have
set to DNAT to my shell server. I'll be more detailed below.
The setup: I have a single physical server with two NICs. eth0 is
external and at IP 123.45.67.89. eth1 is internal and has the IP
192.168.0.1. eth1 is SNATting everything behind it. What I'd like to
do is keep the physical/firewall server as clear of services/extra
cruft as I can, and to set up all my services, shell accounts/
applications, etc. on vservers.
Vservers: I have two. 192.168.0.2, services, will run mail, jabber,
etc. with relevant ports forwarded from the firewall and external
access allowed to whichever ports are necessary. 192.168.0.3, shell,
is a shell server. All user applications are hosted here.
Additionally, any attempts to SSH to 123.45.67.89 will redirect to
this shell server.
For reference, I've followed the instructions at http://
www.shorewall.net/two-interface.htm very closely.
What works? I can connect to the vservers locally. Both services and
shell are running separate sshd instances. Both can connect out fine.
I've run apt updates, connected to IRC via screened client, done a
number of things to test the setup. Everything connects and works
together fine locally. I even have the servers connecting to the
firewall and authenticating users/groups via LDAP. Desktop machines
behind the firewall NAT fine, services running directly on the
firewall work . . .
What I cannot do is connect to a service hosted on a vserver from
outside, through the firewall. To decomplicate matters, I've settled
on trying to get an SSH connection to my shell server working from
outside.
To reiterate, this works fine internally. There is a separate sshd
instance listening exclusively on 192.168.0.3, and all sshds are
listening to single IPs. I have a running screen that is connecting
via IRC outside. Here is my shorewall DNAT rule in /etc/shorewall/rules:
# Redirect inbound SSH connections to shell host.
SSH/DNAT net loc:192.168.0.3
Any attempts to connect from outside time out, however.
So I followed some of the DNAT troubleshooting links listed in the
above guide. The following text is cut for convenience from http://
www.shorewall.net/FAQ.htm#faq1b:
---
(FAQ 1b) I'm still having problems with port forwarding
Answer: To further diagnose this problem:
As root, type “ iptables -t nat -Z ”. This clears the NetFilter
counters in the nat table.
Try to connect to the redirected port from an external host.
As root type “ shorewall show nat ”
Locate the appropriate DNAT rule. It will be in a chain called
<source zone>_dnat (“net_dnat” in the above examples).
Is the packet count in the first column non-zero? If so, the
connection request is reaching the firewall and is being redirected
to the server. In this case, the problem is usually a missing or
incorrect default gateway setting on the local system (the system you
are trying to forward to -- its default gateway should be the IP
address of the firewall's interface to that system).
---
I do this, try SSHing in and the packet count steadily rises. I also
note that, when I run /sbin/route I get the following:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref
Use Iface
66.93.216.0 * 255.255.255.0 U 0 0
0 eth0
192.168.0.0 * 255.255.255.0 U 0 0
0 *
192.168.0.0 * 255.255.255.0 U 0 0
0 eth0
default er1.dfw1.speake 0.0.0.0 UG 0 0
0 eth0
So it looks as if the vserver is using the same gateway as my
firewall, instead of using the firewall itself.
Am I on the right track with this? If so, I have some questions:
1. Why does traffic which I originate from the vserver (vs. traffic
originating from the outside) work if I need to have a default
gateway set?
2. How do I set my vservers to route all traffic through the
firewall so DNAT works as it should?
3. I'm not very knowledgeable about routing/iptables. Is there a
better firewalling solution than shorewall for what I'm trying?
I'm in a bit of an icky situation in that I had a working FreeBSD
setup with jails, pondered switching it to Debian with vservers,
finished the install just in time for it to fail. :( Now I'm trying
to quickly get these vservers running so I can have my services back,
and as great as it would be to plunk down a bunch of time to learn
all of this stuff first (which was the original plan) I'm stuck with
throwing something together quickly, then teaching myself various
linux firewallisms. :)
_______________________________________________
Vserver mailing list
[email protected]
http://list.linux-vserver.org/mailman/listinfo/vserver
