[Firehol-support] Routing between virtual interfaces

[M. O.]

I added the log parameter to all router statements in my firehol config file. If I try to access the device this gets print out in /var/log/syslog a couple of times:

Feb  1 16:57:14 ds10 kernel: 'COMPA2COMPB:'IN=eth0 OUT=eth0 SRC=192.168.0.4 DST=192.168.1.51 LEN=64 TOS=0x00 PREC=0x00 TTL=63 ID=58299 DF PROTO=TCP SPT=51215 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0

But nothing happens -- no ping works neither does accessing B's web interface. Besides the line above, nothing else gets logged. So the firewall seems to work fine, but where's the backward traffic from COMPB to COMPA? Shouldn't it get logged as well by the router statement? I'm more and more certain that all of this is caused by a switch, a bad wire or a loop within the network. I'll do some investigation on that later.


> Date: Wed, 28 Jan 2009 16:53:12 +0000
> Subject: Re: [Firehol-support] Routing between virtual interfaces
> From: cefrodrigues at gmail.com
> To: mofog at hotmail.com
> CC: firehol-support at lists.sourceforge.net
> 
> On Wed, Jan 28, 2009 at 4:07 PM, M. O. <mofog at hotmail.com> wrote:
> > Still, how could the routing possibly work though the firewall, and
> > therefore the routing, has been shut down?
> 
> Routing is completely independent of the firewall.
> 
> When "/proc/sys/net/ipv4/ip_forward" is enabled, routing is enabled.
> The firewall (iptables) allows you to control what can pass and what
> can't, it does not control routing itself.
> 
> In fact you can do advanced routing configurations without having any
> kind of firewall (just "man ip" and see the "route" section), but I
> don't think that applies to your case.
> 
> Now, when you enable firehol, it enables the stateful part of iptables
> (ip_conntrack). In its most simple aspect, this means when a
> connection is established from A to B, this is memorized by the the
> firewall so that corresponding traffic from B to A can flow. You can
> see the list of memorized connections by catting the
> "/proc/net/ip_conntrack" file.
> 
> If there are no problems when the firewall is down, but when it is up
> sometimes it works and sometimes it doesn't, then it really looks like
> a connection tracking issue. You can add "log" parameters to some
> rules in the firehol configuration and then see what gets blocked. If
> there's stuff (that should be allowed) being blocked by the firewall,
> the logging information should provide some clues as to why.
> 
> Regards,
> 
> -- 
> Carlos Rodrigues

_________________________________________________________________
http://redirect.gimas.net/?n=M0902xSearchVideo
Videosuche - Ganz einfach mit der Live Search
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.firehol.org/pipermail/firehol-support/attachments/20090201/33e88a00/attachment-0002.html>