Re: [Vserver] Vservers behind shorewall firewall

From: Herbert Poetzl <herbert_at_13thfloor.at>
Date: Tue 24 Jan 2006 - 22:28:56 GMT
Message-ID: <20060124222856.GA18116@MAIL.13thfloor.at>

On Tue, Jan 24, 2006 at 01:23:58PM -0600, Nolan Darilek wrote:
> I hope this is the correct list for these sorts of questions. I've
> been googling for solutions for the past day or so and haven't found
> anything. Also, someone posted to this list a few weeks ago with the
> exact problem I'm having, but I couldn't seem to find whether or not
> it had been solved. If I've missed it, or if you want to come forward
> and tell me how you did it, I'd very much appreciate it.
>
> Summary: I have a linux firewall behind which I have two vservers and
> a number of desktop machines. I'm using Shorewall (http://
> www.shorewall.net) for the iptables setup. Despite the fact that most
> of my network works, I cannot connect to an SSH server which I have
> set to DNAT to my shell server. I'll be more detailed below.
>
> The setup: I have a single physical server with two NICs. eth0 is
> external and at IP 123.45.67.89. eth1 is internal and has the IP
> 192.168.0.1. eth1 is SNATting everything behind it. What I'd like to
> do is keep the physical/firewall server as clear of services/extra
> cruft as I can, and to set up all my services, shell accounts/
> applications, etc. on vservers.
>
> Vservers: I have two. 192.168.0.2, services, will run mail, jabber,
> etc. with relevant ports forwarded from the firewall and external
> access allowed to whichever ports are necessary. 192.168.0.3, shell,
> is a shell server. All user applications are hosted here.
> Additionally, any attempts to SSH to 123.45.67.89 will redirect to
> this shell server.
>
> For reference, I've followed the instructions at http://
> www.shorewall.net/two-interface.htm very closely.
>
> What works? I can connect to the vservers locally. Both services and
> shell are running separate sshd instances. Both can connect out fine.
> I've run apt updates, connected to IRC via screened client, done a
> number of things to test the setup. Everything connects and works
> together fine locally. I even have the servers connecting to the
> firewall and authenticating users/groups via LDAP. Desktop machines
> behind the firewall NAT fine, services running directly on the
> firewall work . . .
>
> What I cannot do is connect to a service hosted on a vserver from
> outside, through the firewall. To decomplicate matters, I've settled
> on trying to get an SSH connection to my shell server working from
> outside.
>
> To reiterate, this works fine internally. There is a separate sshd
> instance listening exclusively on 192.168.0.3, and all sshds are
> listening to single IPs. I have a running screen that is connecting
> via IRC outside. Here is my shorewall DNAT rule in /etc/shorewall/rules:
>
>
> # Redirect inbound SSH connections to shell host.
> SSH/DNAT net loc:192.168.0.3
>
> Any attempts to connect from outside time out, however.

as the guests reside on the firewall, they will not
'forward' packets to the host, instead they will, as
the networking _is_ on the host, simply use the host
routing to send and/or receive packets ...

now, that means two things, one which you seem to have
mastered already, namely SNAT-ing the outgoing traffic
to the public IP, nevertheless I'll mention it here
again so that we know what we are talking about:

basically a rule like this (no idea how to do that
with shorewall) allows your guests to reach the big
world ...

iptables -t nat -I POSTROUTING -s 192.168.0.2 -j SNAT --to 123.45.67.89

you can spice that up with outgoing interface and/or
use a special chain for all guests, or just repeat it
for every guest ...

now for incoming traffic, you have to do a similar
trick to 'map' the public IP (which will be reached
from the outside) to your guests ...

note: this is _not_ required for packets reaching
the machine on the 192.168.0.x network as they will
already use the proper interface and address

something like

iptables -t nat -I PREROUTING -i eth0 -d 123.45.67.89 \
        -p tcp --dport 2222 -j DNAT --to 192.168.0.2:22

should allow you to reach the first guest's sshd
(assumed it doesn't clash with the host's sshd)
from the outside .. of course, the previous SNAT
rule is required to get the replies back ...

using tcpdump on the host usually shows you which
network translation is missing ...

> So I followed some of the DNAT troubleshooting links listed in the
> above guide. The following text is cut for convenience from http://
> www.shorewall.net/FAQ.htm#faq1b:
>
> ---
> (FAQ 1b) I'm still having problems with port forwarding
>
> Answer: To further diagnose this problem:
>
> As root, type ? iptables -t nat -Z ?. This clears the NetFilter
> counters in the nat table.
> Try to connect to the redirected port from an external host.
> As root type ? shorewall show nat ?
> Locate the appropriate DNAT rule. It will be in a chain called
> <source zone>_dnat (?net_dnat? in the above examples).
> Is the packet count in the first column non-zero? If so, the
> connection request is reaching the firewall and is being redirected
> to the server. In this case, the problem is usually a missing or
> incorrect default gateway setting on the local system (the system you
> are trying to forward to -- its default gateway should be the IP
> address of the firewall's interface to that system).
> ---
>
> I do this, try SSHing in and the packet count steadily rises. I also
> note that, when I run /sbin/route I get the following:
>
> Kernel IP routing table
> Destination Gateway Genmask Flags Metric Ref
> Use Iface
> 66.93.216.0 * 255.255.255.0 U 0 0
> 0 eth0
> 192.168.0.0 * 255.255.255.0 U 0 0
> 0 *
> 192.168.0.0 * 255.255.255.0 U 0 0
> 0 eth0
> default er1.dfw1.speake 0.0.0.0 UG 0 0
> 0 eth0
>
> So it looks as if the vserver is using the same gateway as my
> firewall, instead of using the firewall itself.

it cannot use the firewall as gateway, as it is the
same machine and networking happens on the host ...

> Am I on the right track with this? If so, I have some questions:
>
> 1. Why does traffic which I originate from the vserver (vs. traffic
> originating from the outside) work if I need to have a default
> gateway set?

probably the first rule is there :)

> 2. How do I set my vservers to route all traffic through the
> firewall so DNAT works as it should?

move the vservers to a different machine :)

> 3. I'm not very knowledgeable about routing/iptables. Is there a
> better firewalling solution than shorewall for what I'm trying?
>
> I'm in a bit of an icky situation in that I had a working FreeBSD
> setup with jails, pondered switching it to Debian with vservers,
> finished the install just in time for it to fail. :( Now I'm trying
> to quickly get these vservers running so I can have my services back,
> and as great as it would be to plunk down a bunch of time to learn
> all of this stuff first (which was the original plan) I'm stuck with
> throwing something together quickly, then teaching myself various
> linux firewallisms. :)

HTH,
Herbert
>
> _______________________________________________
> Vserver mailing list
> Vserver@list.linux-vserver.org
> http://list.linux-vserver.org/mailman/listinfo/vserver
_______________________________________________
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver
Received on Tue Jan 24 22:29:18 2006

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Tue 24 Jan 2006 - 22:29:24 GMT by hypermail 2.1.8