From: Marco G. - i. G. <mga...@in...> - 2013-08-06 08:19:24
|
I explained my problem earlier this thread. I added the routes in the endian GUI. But Endian does not set routes, it uses iptables. And that does not work for ICMP as it seems, at least not on the endian. If I set the routes manually, it works as expected. Best regards, Marco Von: Jonathan Lessa [mailto:jon...@gm...] Gesendet: Freitag, 2. August 2013 19:59 An: efw...@li... Betreff: Re: [Efw-user] Routing and ICMP But you need to add the route to have communication with another network. What is the problem? If your network gateway is the Endian is it then that should be the routes to other networks. 2013/8/2 Marco Gabriel - inett GmbH <mga...@in... <mailto:mga...@in...> > Understood. I already tried to create a specific rule for ICMP traffic within the firewall (exactly at policy based routing). It showed me ICMP 8 and ICMP 30 to allow, but that didn’t work either. The only thing that worked so far was adding a route. Marco Von: Jonathan Lessa [mailto:jon...@gm... <mailto:jon...@gm...> ] Gesendet: Freitag, 2. August 2013 17:33 An: efw...@li... <mailto:efw...@li...> Betreff: Re: [Efw-user] Routing and ICMP But the issue is not the area in itself, but when do you configure a rule to redirect the Endian already takes care of creating a rule in the firewall to release this communication. What I asked was to test the firewall to create a rule allowing ICMP between these networks. 2013/8/2 Marco Gabriel - inett GmbH <mga...@in... <mailto:mga...@in...> > There are two LANs, connected through two cisco boxes. LAN1 contains client and cisco box 1, LAN2 contains endian, server and cisco box 2. There is no need to play with the zones as everything for LAN1 should be routed through the cisco box 2. And that works for all services but ICMP. Best regards, Marco Von: Jonathan Lessa [mailto:jon...@gm... <mailto:jon...@gm...> ] Gesendet: Freitag, 2. August 2013 17:23 An: efw...@li... <mailto:efw...@li...> Betreff: Re: [Efw-user] Routing and ICMP I understood that all involved were on the same LAN green, but in this case they are not. Outside the routing would be interesting to create a rule in the firewall between zones. Releasing the ping between the 192.168.10.0/24 <http://192.168.10.0/24> network and the Green Zone. |