Re: [Shorewall-users] Routing network traffic via VPN

[Tom Eastep <teastep@sh...>]

On 01/05/2013 02:40 PM, f q wrote:
> Also, I think you want USE_DEFAULT_RT=Yes. I don't see how
> USE_DEFAULT_RT=No can possiblly work here, since you have to be able to
> route between the interfaces and both are provider interfaces.
> 
> 1) I made the changes as you requested, and set "USE_DEFAULT_RT=Yes",
> in /etc/shorewall/shorewall.conf.
> 2) I issued a /sbin/shorewall restart to re-read the configuration
> file (I'm not sure this is entirely required, but I wanted to be sure
> the new changes were being reflected in the current running
> configuration)
> 3) Applied the configuration for the firewall, normal warnings:
> Adding Providers...
>    WARNING: Interface tun0 is not usable -- Provider iPredator (2) not Started
>    WARNING: No Default route added (all 'balance' providers are down)
>    NOTICE: Default route restored
> 4) Connected to OpenVPN
> 5) Attempted to re-apply the firewall configuration, as before (no errors)
> 6) Attempted pings to verify connection (they traversed the VPN correctly)
> 7) Disconnected from the VPN, traffic then traversed my default
> connection incorrectly.

Come on -- you have to be specific. Exactly what connection did you
attempt that worked when you didn't believe that it should? Give the
source iP address, the destination IP address, protocol and port (if
appropriate).

-Tom
-- 
Tom Eastep        \ When I die, I want to go like my Grandfather who
Shoreline,         \ died peacefully in his sleep. Not screaming like
Washington, USA     \ all of the passengers in his car
http://shorewall.net \________________________________________________

Re: [Shorewall-users] Routing network traffic via VPN

[f q <u.predator.eng@gm...>]

Also, I think you want USE_DEFAULT_RT=Yes. I don't see how
USE_DEFAULT_RT=No can possiblly work here, since you have to be able to
route between the interfaces and both are provider interfaces.

1) I made the changes as you requested, and set "USE_DEFAULT_RT=Yes",
in /etc/shorewall/shorewall.conf.
2) I issued a /sbin/shorewall restart to re-read the configuration
file (I'm not sure this is entirely required, but I wanted to be sure
the new changes were being reflected in the current running
configuration)
3) Applied the configuration for the firewall, normal warnings:
Adding Providers...
   WARNING: Interface tun0 is not usable -- Provider iPredator (2) not Started
   WARNING: No Default route added (all 'balance' providers are down)
   NOTICE: Default route restored
4) Connected to OpenVPN
5) Attempted to re-apply the firewall configuration, as before (no errors)
6) Attempted pings to verify connection (they traversed the VPN correctly)
7) Disconnected from the VPN, traffic then traversed my default
connection incorrectly.

Submitting dump after step 7, as above.


On 1/5/13, Tom Eastep <teastep@...> wrote:
> On 01/05/2013 01:48 PM, Tom Eastep wrote:
>> On 01/05/2013 01:43 PM, f q wrote:
>>> Apologies, we've done so much tweaking trying to resolve the issue, I
>>> haven't posted a current configuration in a bit.  Here's "providers",
>>> I can post the other files as well on request:
>>>
>>> #NAME		NUMBER	MARK	DUPLICATE	INTERFACE	GATEWAY		OPTIONS
>>> loc		1	1	-		eth0		192.168.0.1	track,balance=1
>>> iPredator	2	2	-		tun0		-		track,balance=2
>>>
>>
>> But you didn't make the change that I recommended to put 'balance' on
>> iPredator and 'fallback' on 'loc'.
>>
>
> Also, I think you want USE_DEFAULT_RT=Yes. I don't see how
> USE_DEFAULT_RT=No can possiblly work here, since you have to be able to
> route between the interfaces and both are provider interfaces.
>
> -Tom
> --
> Tom Eastep        \ When I die, I want to go like my Grandfather who
> Shoreline,         \ died peacefully in his sleep. Not screaming like
> Washington, USA     \ all of the passengers in his car
> http://shorewall.net \________________________________________________
>
>

Re: [Shorewall-users] Routing network traffic via VPN

[f q <u.predator.eng@gm...>]

With the configuration as follows (with the upgraded Shorewall from
the repository you directed me to), I followed these steps and
submitted the dump as requested after step 4:

"interfaces":

#ZONE	INTERFACE	BROADCAST	OPTIONS
net     eth0            detect
dhcp,tcpflags,nosmurfs,routefilter,logmartians,required
vpn     tun0		detect          optional

"providers":

#NAME		NUMBER	MARK	DUPLICATE	INTERFACE	GATEWAY		OPTIONS
loc		1	1	-		eth0		192.168.0.1	track,balance=1
iPredator	2	2	-		tun0		-		track,balance=2

1) I am able to apply the firewall configuration before connecting to
OpenVPN, with the normal error: "WARNING: Interface tun0 is not usable
-- Provider iPredator (2) not Started"
2) I am then able to connect to OpenVPN normally.
3) I can then re-apply the firewall configuration without error / warning.
4) I attempt to ping to verify my connection and all such packets are dropped
5) I then disconnect from OpenVPN and I get the error "connect:
Network is unreachable" when attempting to ping / reconnect to OpenVPN
6) I then re-apply my firewall configuration
7) Ping's function normally and I can reconnect to OpenVPN (which
functions normally)

On 1/5/13, Tom Eastep <teastep@...> wrote:
> On 01/05/2013 01:36 PM, f q wrote:
>> As requested, please find attached.
>>
>
> And what exactly did you try with this configuration that didn't work?
>
> -Tom
>
> --
> Tom Eastep        \ When I die, I want to go like my Grandfather who
> Shoreline,         \ died peacefully in his sleep. Not screaming like
> Washington, USA     \ all of the passengers in his car
> http://shorewall.net \________________________________________________
>
>

Re: [Shorewall-users] Routing network traffic via VPN

[f q <u.predator.eng@gm...>]

I didn't think to make the change you had recommended on 01/03 again
with the new software, apologies.

"interfaces":

#ZONE	INTERFACE	BROADCAST	OPTIONS
net     eth0            detect
dhcp,tcpflags,nosmurfs,routefilter=0,logmartians,required
vpn     tun0		detect          optional,routefilter=0

"providers":

#NAME		NUMBER	MARK	DUPLICATE	INTERFACE	GATEWAY		OPTIONS
loc		1	1	-		eth0		192.168.0.1	track,fallback=1
iPredator	2	2	-		tun0		-		track,balance=2

So tracing back through the steps:

1) I am able to apply the firewall configuration before connecting to
OpenVPN, with a new error:

"
Adding Providers...
   WARNING: Interface tun0 is not usable -- Provider iPredator (2) not Started
   WARNING: No Default route added (all 'balance' providers are down)
   NOTICE: Default route restored
"

2) I am then able to connect to OpenVPN normally.
3) I can then re-apply the firewall configuration without error / warning.
4) I attempt to ping to verify my connection and all such packets are dropped
5) I then disconnect from OpenVPN and I get the error "connect:
Network is unreachable" when attempting to ping / reconnect to OpenVPN
6) I then re-apply my firewall configuration
7) Ping's function normally and I can reconnect to OpenVPN (which
functions normally

The dump attached is taken after step 4, with the above new
configuration applied.

On 1/5/13, Tom Eastep <teastep@...> wrote:
> On 01/05/2013 01:43 PM, f q wrote:
>> Apologies, we've done so much tweaking trying to resolve the issue, I
>> haven't posted a current configuration in a bit.  Here's "providers",
>> I can post the other files as well on request:
>>
>> #NAME		NUMBER	MARK	DUPLICATE	INTERFACE	GATEWAY		OPTIONS
>> loc		1	1	-		eth0		192.168.0.1	track,balance=1
>> iPredator	2	2	-		tun0		-		track,balance=2
>>
>
> But you didn't make the change that I recommended to put 'balance' on
> iPredator and 'fallback' on 'loc'.
>
> -Tom
> --
> Tom Eastep        \ When I die, I want to go like my Grandfather who
> Shoreline,         \ died peacefully in his sleep. Not screaming like
> Washington, USA     \ all of the passengers in his car
> http://shorewall.net \________________________________________________
>
>

Re: [Shorewall-users] Routing network traffic via VPN

[Tom Eastep <teastep@sh...>]

On 01/05/2013 01:48 PM, Tom Eastep wrote:
> On 01/05/2013 01:43 PM, f q wrote:
>> Apologies, we've done so much tweaking trying to resolve the issue, I
>> haven't posted a current configuration in a bit.  Here's "providers",
>> I can post the other files as well on request:
>>
>> #NAME		NUMBER	MARK	DUPLICATE	INTERFACE	GATEWAY		OPTIONS
>> loc		1	1	-		eth0		192.168.0.1	track,balance=1
>> iPredator	2	2	-		tun0		-		track,balance=2
>>
> 
> But you didn't make the change that I recommended to put 'balance' on
> iPredator and 'fallback' on 'loc'.
> 

Also, I think you want USE_DEFAULT_RT=Yes. I don't see how
USE_DEFAULT_RT=No can possiblly work here, since you have to be able to
route between the interfaces and both are provider interfaces.

-Tom
-- 
Tom Eastep        \ When I die, I want to go like my Grandfather who
Shoreline,         \ died peacefully in his sleep. Not screaming like
Washington, USA     \ all of the passengers in his car
http://shorewall.net \________________________________________________

Re: [Shorewall-users] Routing network traffic via VPN

[Tom Eastep <teastep@sh...>]

On 01/05/2013 01:36 PM, f q wrote:
> As requested, please find attached.
> 

And what exactly did you try with this configuration that didn't work?

-Tom

-- 
Tom Eastep        \ When I die, I want to go like my Grandfather who
Shoreline,         \ died peacefully in his sleep. Not screaming like
Washington, USA     \ all of the passengers in his car
http://shorewall.net \________________________________________________

Re: [Shorewall-users] Routing network traffic via VPN

[Tom Eastep <teastep@sh...>]

On 01/05/2013 01:43 PM, f q wrote:
> Apologies, we've done so much tweaking trying to resolve the issue, I
> haven't posted a current configuration in a bit.  Here's "providers",
> I can post the other files as well on request:
> 
> #NAME		NUMBER	MARK	DUPLICATE	INTERFACE	GATEWAY		OPTIONS
> loc		1	1	-		eth0		192.168.0.1	track,balance=1
> iPredator	2	2	-		tun0		-		track,balance=2
>

But you didn't make the change that I recommended to put 'balance' on
iPredator and 'fallback' on 'loc'.

-Tom
-- 
Tom Eastep        \ When I die, I want to go like my Grandfather who
Shoreline,         \ died peacefully in his sleep. Not screaming like
Washington, USA     \ all of the passengers in his car
http://shorewall.net \________________________________________________

Re: [Shorewall-users] Routing network traffic via VPN

[f q <u.predator.eng@gm...>]

Apologies, we've done so much tweaking trying to resolve the issue, I
haven't posted a current configuration in a bit.  Here's "providers",
I can post the other files as well on request:

#NAME		NUMBER	MARK	DUPLICATE	INTERFACE	GATEWAY		OPTIONS
loc		1	1	-		eth0		192.168.0.1	track,balance=1
iPredator	2	2	-		tun0		-		track,balance=2

On 1/5/13, Tom Eastep <teastep@...> wrote:
> On 01/05/2013 07:42 AM, Tom Eastep wrote:
>> On 01/04/2013 01:07 PM, f q wrote:
>>> I did as you suggested and upgraded to the latest version in
>>> repository linked from the download page.
>>>
>>> shorewall, shorewall-core, shorewall-init: 4.5.5.3-1~bpo60+1
>>>
>>> After upgrading I modified the the 'rtrules' file to:
>>>
>>> #SOURCE     DEST      PROVIDER        PRIORITY
>>> lo           -         iPredator       11999
>>>
>>> As there was an error with leaving both "SOURCE" and "DESTINATION" set
>>> to "-", despite the example I lifted it from.
>>>
>>> 1) I am able to apply the firewall configuration before connecting to
>>> OpenVPN, with the normal error: "WARNING: Interface tun0 is not usable
>>> -- Provider iPredator (2) not Started"
>>> 2) I am then able to connect to OpenVPN normally.
>>> 3) I can then re-apply the firewall configuration without error /
>>> warning.
>>> 4) I attempt to ping to verify my connection and all such packets are
>>> dropped
>>> 5) I then disconnect from OpenVPN and I get the error "connect:
>>> Network is unreachable" when attempting to ping / reconnect to OpenVPN
>>> 6) I then re-apply my firewall configuration
>>> 7) Ping's function normally and I can reconnect to OpenVPN (which
>>> functions normally)
>>>
>>> So, similar behavior before the upgrade, but I can no longer use the
>>> OpenVPN connection when the firewall is "fully applied".
>>>
>>> Attached please find a new dump, taken directly after step 5, as above.
>>
>> Let's solve the problems one at a time. Please forward a dump taken
>> after step 4.
>
> You have 'fallback' on the 'loc' provider?
>
> -Tom
> --
> Tom Eastep        \ When I die, I want to go like my Grandfather who
> Shoreline,         \ died peacefully in his sleep. Not screaming like
> Washington, USA     \ all of the passengers in his car
> http://shorewall.net \________________________________________________
>
>

Re: [Shorewall-users] Routing network traffic via VPN

[f q <u.predator.eng@gm...>]

As requested, please find attached.

On 1/5/13, Tom Eastep <teastep@...> wrote:
> On 01/04/2013 01:07 PM, f q wrote:
>> I did as you suggested and upgraded to the latest version in
>> repository linked from the download page.
>>
>> shorewall, shorewall-core, shorewall-init: 4.5.5.3-1~bpo60+1
>>
>> After upgrading I modified the the 'rtrules' file to:
>>
>> #SOURCE     DEST      PROVIDER        PRIORITY
>> lo           -         iPredator       11999
>>
>> As there was an error with leaving both "SOURCE" and "DESTINATION" set
>> to "-", despite the example I lifted it from.
>>
>> 1) I am able to apply the firewall configuration before connecting to
>> OpenVPN, with the normal error: "WARNING: Interface tun0 is not usable
>> -- Provider iPredator (2) not Started"
>> 2) I am then able to connect to OpenVPN normally.
>> 3) I can then re-apply the firewall configuration without error /
>> warning.
>> 4) I attempt to ping to verify my connection and all such packets are
>> dropped
>> 5) I then disconnect from OpenVPN and I get the error "connect:
>> Network is unreachable" when attempting to ping / reconnect to OpenVPN
>> 6) I then re-apply my firewall configuration
>> 7) Ping's function normally and I can reconnect to OpenVPN (which
>> functions normally)
>>
>> So, similar behavior before the upgrade, but I can no longer use the
>> OpenVPN connection when the firewall is "fully applied".
>>
>> Attached please find a new dump, taken directly after step 5, as above.
>
> Let's solve the problems one at a time. Please forward a dump taken
> after step 4.
>
> -Tom
> --
> Tom Eastep        \ When I die, I want to go like my Grandfather who
> Shoreline,         \ died peacefully in his sleep. Not screaming like
> Washington, USA     \ all of the passengers in his car
> http://shorewall.net \________________________________________________
>
>

Re: [Shorewall-users] Routing network traffic via VPN

[Tom Eastep <teastep@sh...>]

On 01/05/2013 07:42 AM, Tom Eastep wrote:
> On 01/04/2013 01:07 PM, f q wrote:
>> I did as you suggested and upgraded to the latest version in
>> repository linked from the download page.
>>
>> shorewall, shorewall-core, shorewall-init: 4.5.5.3-1~bpo60+1
>>
>> After upgrading I modified the the 'rtrules' file to:
>>
>> #SOURCE     DEST      PROVIDER        PRIORITY
>> lo           -         iPredator       11999
>>
>> As there was an error with leaving both "SOURCE" and "DESTINATION" set
>> to "-", despite the example I lifted it from.
>>
>> 1) I am able to apply the firewall configuration before connecting to
>> OpenVPN, with the normal error: "WARNING: Interface tun0 is not usable
>> -- Provider iPredator (2) not Started"
>> 2) I am then able to connect to OpenVPN normally.
>> 3) I can then re-apply the firewall configuration without error / warning.
>> 4) I attempt to ping to verify my connection and all such packets are dropped
>> 5) I then disconnect from OpenVPN and I get the error "connect:
>> Network is unreachable" when attempting to ping / reconnect to OpenVPN
>> 6) I then re-apply my firewall configuration
>> 7) Ping's function normally and I can reconnect to OpenVPN (which
>> functions normally)
>>
>> So, similar behavior before the upgrade, but I can no longer use the
>> OpenVPN connection when the firewall is "fully applied".
>>
>> Attached please find a new dump, taken directly after step 5, as above.
> 
> Let's solve the problems one at a time. Please forward a dump taken
> after step 4.

You have 'fallback' on the 'loc' provider?

-Tom
-- 
Tom Eastep        \ When I die, I want to go like my Grandfather who
Shoreline,         \ died peacefully in his sleep. Not screaming like
Washington, USA     \ all of the passengers in his car
http://shorewall.net \________________________________________________

Re: [Shorewall-users] Routing network traffic via VPN

[Tom Eastep <teastep@sh...>]

On 01/04/2013 01:07 PM, f q wrote:
> I did as you suggested and upgraded to the latest version in
> repository linked from the download page.
> 
> shorewall, shorewall-core, shorewall-init: 4.5.5.3-1~bpo60+1
> 
> After upgrading I modified the the 'rtrules' file to:
> 
> #SOURCE     DEST      PROVIDER        PRIORITY
> lo           -         iPredator       11999
> 
> As there was an error with leaving both "SOURCE" and "DESTINATION" set
> to "-", despite the example I lifted it from.
> 
> 1) I am able to apply the firewall configuration before connecting to
> OpenVPN, with the normal error: "WARNING: Interface tun0 is not usable
> -- Provider iPredator (2) not Started"
> 2) I am then able to connect to OpenVPN normally.
> 3) I can then re-apply the firewall configuration without error / warning.
> 4) I attempt to ping to verify my connection and all such packets are dropped
> 5) I then disconnect from OpenVPN and I get the error "connect:
> Network is unreachable" when attempting to ping / reconnect to OpenVPN
> 6) I then re-apply my firewall configuration
> 7) Ping's function normally and I can reconnect to OpenVPN (which
> functions normally)
> 
> So, similar behavior before the upgrade, but I can no longer use the
> OpenVPN connection when the firewall is "fully applied".
> 
> Attached please find a new dump, taken directly after step 5, as above.

Let's solve the problems one at a time. Please forward a dump taken
after step 4.

-Tom
-- 
Tom Eastep        \ When I die, I want to go like my Grandfather who
Shoreline,         \ died peacefully in his sleep. Not screaming like
Washington, USA     \ all of the passengers in his car
http://shorewall.net \________________________________________________

Re: [Shorewall-users] How could I open Port 1701 for VPN l2tp/ipsec

[Tom Eastep <teastep@sh...>]

On 01/05/2013 01:46 AM, tony.blue.mailinglist@... wrote:
> Am 04.01.2013 22:14, schrieb Tom Eastep:
>> A new problem has emerged: After the entry in the /etc/shorewall/masq
>> shorewall does not work when the device ppp1is not created. If I want to
>> start shorewall I have to make a VPN connection.
>>
>> Is there a way to start shorewall with no VPN connection(no ppp1 ipsec
>> tunnel)?
>> why don't you just do what I shoed you above?
>>
>> -Tom
>>
> 
> Hi Tom,
> 
> please excuse. I was not sure if I post in the shorewall/dump on the
> public list of published data that make my firewall insecure.
> 
> Therefore, I send you the shorewall/dump personaly via email. I hope
> this is okay.
> 
> The structure is like this:
> 
>                                                    +-------- eth2 (dmz
> webserver)
>                                                    |
> Internet --- (dynamic IP) --- ppp0 ---- eth0 (local network)
> |
> +-------- eth3 (wlan)
> |
> +-------- tun0 (open-vpn)
> |
> +-------- ppp1 (vpn ipsec/l2tp)
> 

This single entry will work:

ppp0	192.168.0.0/16

-Tom
-- 
Tom Eastep        \ When I die, I want to go like my Grandfather who
Shoreline,         \ died peacefully in his sleep. Not screaming like
Washington, USA     \ all of the passengers in his car
http://shorewall.net \________________________________________________