2

I'm currently creating network based on Ubuntu Server.

It's implemented as VM in VirtualBox and looks like this:

  1. Ubuntu Server - 3 network interfaces. 1st - enp0s3, internet connection. 2rd - enp0s9, room_two - VBox internal network.
  2. ArchLinux workstation - 1 network interface, enp0s3, connected to room_two.

What I want to achieve: Server routing from enp0s3 to room_two internal network.

What I have done already:

# /etc/netplan/50-cloud-init.yaml

network:
ethernets:
    enp0s3:
        addresses: []
        dhcp4: true
    enp0s8:
        addresses: [192.168.1.1/16]
        dhcp4: false
version: 2

Shorewall setup for two interface router.

/etc/shorewall/zones

#ZONE   TYPE    OPTIONS                 IN                      OUT
#                                       OPTIONS                 OPTIONS
fw      firewall
net     ipv4
loc     ipv4

/etc/shorewall/rules

#ACTION         SOURCE          DEST            PROTO   DEST    SOURCE          ORIGINAL        RATE            USER/   MARK    CONNLIMIT       TIME            HEADERS         SWITCH          HELPER
#                                                       PORT    PORT(S)         DEST            LIMIT           GROUP
?SECTION ALL
?SECTION ESTABLISHED
?SECTION RELATED
?SECTION INVALID
?SECTION UNTRACKED
?SECTION NEW

#       Don't allow connection pickup from the net
#
Invalid(DROP)   net             all             tcp
#
#       Accept DNS connections from the firewall to the network
#
DNS(ACCEPT)     $FW             net
DNS(ACCEPT)     loc             $FW
#
#       Accept SSH connections from the local network for administration
#
SSH(ACCEPT)     loc             $FW
SSH(ACCEPT)     net             $FW
#
#       Allow Ping from the local network
#
Ping(ACCEPT)    loc             $FW
Ping(ACCEPT)    $FW             loc

#
# Drop Ping from the "bad" net zone.. and prevent your log from being flooded..
#

Ping(DROP)      net             $FW

ACCEPT          $FW             loc             icmp
ACCEPT          $FW             net             icmp
#

/etc/shorewall/policy

#SOURCE DEST            POLICY          LOGLEVEL        RATE    CONNLIMIT

$FW     net             ACCEPT
loc     net             ACCEPT
net     all             DROP            $LOG_LEVEL
# THE FOLOWING POLICY MUST BE LAST
all     all             REJECT          $LOG_LEVEL

/etc/shorewall/interfaces

#ZONE   INTERFACE       OPTIONS
net     NET_IF          dhcp,tcpflags,nosmurfs,routefilter,logmartians,sourceroute=0,physical=enp0s3
loc     LOC_IF          dhcp,tcpflags,nosmurfs,routefilter,logmartians,physical=enp0s8

/etc/shorewall/snat

# Rules generated from masq file /home/teastep/shorewall/trunk/Shorewall/Samples/two-interfaces/masq by Shorewall 5.0.13-RC1 - Sat Oct 15 11:41:40 PDT 2016
#
MASQUERADE              10.0.0.0/8,\
                        169.254.0.0/16,\
                        172.16.0.0/12,\
                        192.168.0.0/16          NET_IF

My Ubuntu Server works fine, DNS requests are cached and I can access internet. On my ArchLinux client I get an IP address from DHCP server and when I 'ping google.com' I get proper IP address but I get 100% packet loss. Where should I look for info and what kind? What may I have done wrong? There is not so many resources about Shorewall + Netplan setup as the latter is quite new.

1
  • I'd like to mention that both Ubuntu Server VM and Arch Linux VM can ping each other over internal network. Oct 1, 2018 at 10:41

1 Answer 1

0

I found the solution, in /etc/sysctl.conf: net.ipv4.ip_forward=1

Now everything works flawlessly!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.