Shorewall:FORWARD:REJECT (I'm at my wit's end)

Discussion in 'Installation/Configuration' started by chris.zeman, Jul 20, 2006.

  1. chris.zeman

    chris.zeman New Member

    I have been attempting to make this work for the past 12 hours. :mad:

    I am running SuSE 10.1 with Shorewall and 3 NIC's.
    eth0: 10.x.xx.xxx 255.255.0.0 (Connects to Router)
    eth1: 10.xxx.x.xxx 255.255.0.0 (Reserved for a future project)
    eth2: 172.xx.x.x 255.255.0.0 (Connected to LAN)

    This machine is our LAN's internet gateway, among other things. Another server on our network is connected to the company's LAN, and is our department LAN's gateway to the company network. My route has been configured, as shown below.
    Code:
    Kernel IP routing table
    Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
    10.xxx.0.0      172.16.xxx.xxx  255.255.0.0     UG    0      0        0 eth2
    Unfortunately, none of the computers on our LAN are able to access the 10.115.0.0 network. This is what shows up in the firewall log:
    Code:
    Jul 20 01:21:56 automation kernel: Shorewall:FORWARD:REJECT:IN=eth2 OUT=eth2 SRC=172.16.x.x DST=10.xxx.x.xx LEN=106 TOS=0x00 PREC=0x00 TTL=127 ID=41313 PROTO=UDP SPT=1066 DPT=161 LEN=86
    The routing work if I execute "shorewall clear", so I know I'm at the final hurdle. I've found information on how to Proxy ARP, but a lot of it isn't exactly clear to me or doesn't pertain to my situation. I could be wrong, though. I just need some help. :(

    Thank you,
    Chris
     
    Last edited: Jul 22, 2006
  2. falko

    falko Super Moderator Howtoforge Staff

    Shouldn't this be
    eth0: 10.1.10.250 255.0.0.0 (Connects to Router)
    eth1: 10.120.2.250 255.0.0.0 (Reserved for a future project)
    instead?
     
  3. chris.zeman

    chris.zeman New Member

    Not unless I'm missing something. :)

    eth1 connects to the router supplied to us by Comcast, and the router is configured for 255.255.0.0.

    eth2 is going to connect to an entirely different physical network in the near future.

    Chris
     

Share This Page