Forget about my part to nat file. I was wrong. Try my masq configuration.


Von: Michael Weickel - iQom Business Services GmbH []
Gesendet: Di
enstag, 2. März 2010 00:17
An: 'Shorewall Users'
Betreff: AW: [Shorewall-users] NAT Issue


Try    eth0    no    no


INTERFACE - interfacelist[:[digit]]

Interfacees that have the EXTERNAL address

But its more often done by usage of masq instead of nat


put to your masq file


vlan350            eth1: 


The benefit of masq is to have control about proto and port as well.


If you use masq you can delete your nat file entry.


If you tar.bz2 your dump it should become smaller. Try 'tar -cjf status.txt.tar.bz2 {your dump file}'





Von: Red Baron []
Gesendet: Montag, 1. März 2010 23:54
An: Shorewall Users
Betreff: [Shorewall-users] NAT Issue


shorewall-lite version 4.4.6
Debian Lenny -  2.6.26-2-686

I have a large network of public IPS ( )

I have broken this up into several smaller subnets. I have a few servers that I want to NAT translate from my gateway server to a public IP on VLAN350. which is subnet / 27.

My gateway server has the following interfaces

eth0 - /28
eth1 - /24
vlan350 - /27

I have this entry in the nat configuration file:
#EXTERNAL    INTERFACE    INTERNAL    ALL        LOCAL    vlan350    no    no

but when the host pings the internet, the IP is masquerarded as, not

>From the gateway, I can do the following

ping -I

and I do get replies, and tcpdump on the gateway verifies that the IP being used is correct, so I know the routes are in place.

Any suggestions as to what I might be doing wrong?

The dump file is over 50k even after sending.