Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have installed and configured Shorewall with two ISPs. I want to provide Internet access to the clients and the other connection for servers connection and NATs.

I can navigate both from the clients zone and DMZ zone, but I can't use the services of the servers outside the LAN. I sniffed packets in both sites (LAN and out the LAN) and I see that servers in DMZ receive NATed packets and answer them, but it seems that the packets didn't return to the outside client.

Can anyone help me? These are the config files of my installation:

    > cat interfaces
net     eth0            detect          dhcp,routeback,blacklist,tcpflags,nosmurfs,routefilter,logmartians
net     eth1            detect          dhcp,routeback,blacklist,tcpflags,nosmurfs,routefilter,logmartians
loc     eth2            detect          dhcp,routeback,blacklist,tcpflags,nosmurfs,routefilter,logmartians
dmz     eth3            detect          dhcp,routeback,blacklist,tcpflags,nosmurfs,routefilter,logmartians

> cat zones
#ZONE   TYPE    OPTIONS                 IN                      OUT                            OPTIONS                 OPTIONS
fw      firewall
net     ipv4
loc     ipv4
dmz     ipv4

>  cat providers
ADSL2   2       0x2     main            eth1            8x.xx.1x7.1     track,balance           eth2,eth3
ADSL1   1       0x1     main            eth0            8y.yy.2y1.2     track,balance           eth2,eth3

> cat mask
#INTERFACE              SOURCE          ADDRESS         PROTO   PORT(S) IPSEC   MARK
eth0                    8y.yy.2y1.yy6   8x.xx.1x7.xx2
eth0                    eth2            8y.yy.2y1.yy6
eth0                    eth3            8y.yy.2y1.yy6
eth1                    8x.xx.1x7.xx2   8y.yy.2y1.yy6
eth1                    eth2            8x.xx.1x7.xx2
eth1                    eth3            8x.xx.1x7.xx2

> cat rules
DROP:info       net:      all
DROP:info       net:      all
DNS(ACCEPT)     $FW             net:eth0
DNS(ACCEPT)     dmz             net:eth0
HTTP(ACCEPT)    dmz             net:eth0
HTTPS(ACCEPT)   dmz             net:eth0
ACCEPT          net:eth0        dmz
DNAT            net:eth0        dmz:       tcp     80
Ping(DROP)      net:eth1        $FW
Ping(DROP)      net:eth0        $FW
Ping(ACCEPT)    loc             $FW
Ping(ACCEPT)    loc             dmz
Ping(ACCEPT)    dmz             loc
Ping(ACCEPT)    dmz             net:eth0
Ping(ACCEPT)    dmz             $FW
ACCEPT          $FW             loc             icmp
ACCEPT          $FW             dmz             icmp
SSH(ACCEPT)     dmz             $FW

> cat tcrules
#MARK   SOURCE                  DEST        PROTO    DEST_PORT(S)
1:P          -
2:P          -
1       $FW
share|improve this question

The first error I see is that cat mask should be cat masq.

If you have the masq file named mask, it's going to use the default config for masq.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .