I hope this is the correct list for these sorts of questions. I've
been googling for solutions for the past day or so and haven't found
anything. Also, someone posted to this list a few weeks ago with the
exact problem I'm having, but I couldn't seem to find whether or not
it had been solved. If I've missed it, or if you want to come forward
and tell me how you did it, I'd very much appreciate it.
Summary: I have a linux firewall behind which I have two vservers and
a number of desktop machines. I'm using Shorewall (http://
www.shorewall.net) for the iptables setup. Despite the fact that most
of my network works, I cannot connect to an SSH server which I have
set to DNAT to my shell server. I'll be more detailed below.
The setup: I have a single physical server with two NICs. eth0 is
external and at IP 123.45.67.89. eth1 is internal and has the IP
192.168.0.1. eth1 is SNATting everything behind it. What I'd like to
do is keep the physical/firewall server as clear of services/extra
cruft as I can, and to set up all my services, shell accounts/
applications, etc. on vservers.
Vservers: I have two. 192.168.0.2, services, will run mail, jabber,
etc. with relevant ports forwarded from the firewall and external
access allowed to whichever ports are necessary. 192.168.0.3, shell,
is a shell server. All user applications are hosted here.
Additionally, any attempts to SSH to 123.45.67.89 will redirect to
this shell server.
For reference, I've followed the instructions at http://
www.shorewall.net/two-interface.htm very closely.
What works? I can connect to the vservers locally. Both services and
shell are running separate sshd instances. Both can connect out fine.
I've run apt updates, connected to IRC via screened client, done a
number of things to test the setup. Everything connects and works
together fine locally. I even have the servers connecting to the
firewall and authenticating users/groups via LDAP. Desktop machines
behind the firewall NAT fine, services running directly on the
firewall work . . .
What I cannot do is connect to a service hosted on a vserver from
outside, through the firewall. To decomplicate matters, I've settled
on trying to get an SSH connection to my shell server working from
outside.
To reiterate, this works fine internally. There is a separate sshd
instance listening exclusively on 192.168.0.3, and all sshds are
listening to single IPs. I have a running screen that is connecting
via IRC outside. Here is my shorewall DNAT rule in /etc/shorewall/rules:
# Redirect inbound SSH connections to shell host.
SSH/DNAT net loc:192.168.0.3
Any attempts to connect from outside time out, however.
So I followed some of the DNAT troubleshooting links listed in the
above guide. The following text is cut for convenience from http://
www.shorewall.net/FAQ.htm#faq1b:
--- (FAQ 1b) I'm still having problems with port forwarding Answer: To further diagnose this problem: As root, type “ iptables -t nat -Z ”. This clears the NetFilter counters in the nat table. Try to connect to the redirected port from an external host. As root type “ shorewall show nat ” Locate the appropriate DNAT rule. It will be in a chain called <source zone>_dnat (“net_dnat” in the above examples). Is the packet count in the first column non-zero? If so, the connection request is reaching the firewall and is being redirected to the server. In this case, the problem is usually a missing or incorrect default gateway setting on the local system (the system you are trying to forward to -- its default gateway should be the IP address of the firewall's interface to that system). --- I do this, try SSHing in and the packet count steadily rises. I also note that, when I run /sbin/route I get the following: Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 66.93.216.0 * 255.255.255.0 U 0 0 0 eth0 192.168.0.0 * 255.255.255.0 U 0 0 0 * 192.168.0.0 * 255.255.255.0 U 0 0 0 eth0 default er1.dfw1.speake 0.0.0.0 UG 0 0 0 eth0 So it looks as if the vserver is using the same gateway as my firewall, instead of using the firewall itself. Am I on the right track with this? If so, I have some questions: 1. Why does traffic which I originate from the vserver (vs. traffic originating from the outside) work if I need to have a default gateway set? 2. How do I set my vservers to route all traffic through the firewall so DNAT works as it should? 3. I'm not very knowledgeable about routing/iptables. Is there a better firewalling solution than shorewall for what I'm trying? I'm in a bit of an icky situation in that I had a working FreeBSD setup with jails, pondered switching it to Debian with vservers, finished the install just in time for it to fail. :( Now I'm trying to quickly get these vservers running so I can have my services back, and as great as it would be to plunk down a bunch of time to learn all of this stuff first (which was the original plan) I'm stuck with throwing something together quickly, then teaching myself various linux firewallisms. :) _______________________________________________ Vserver mailing list Vserver@list.linux-vserver.org http://list.linux-vserver.org/mailman/listinfo/vserverReceived on Tue Jan 24 19:31:33 2006