<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Still same issue <b>Net2FW</b> is not working . All traffic still
goes thru <b>dmz2FW</b> .Please see given policy we are using<br>
<br>
# From Firewall Policy<br>
#$FW $FW ACCEPT<br>
#$FW net REJECT<br>
#$FW dmz REJECT<br>
#$FW loc ACCEPT<br>
<br>
# From Net Policy<br>
net $FW ACCEPT info 1/sec:2<br>
net all DROP<br>
#net dmz ACCEPT info 8/sec:30<br>
#net loc REJECT info<br>
<br>
<br>
# From DMZ Policy<br>
dmz $FW ACCEPT<br>
dmz net DROP info 1/sec:2<br>
#dmz all DROP<br>
dmz loc ACCEPT info<br>
<br>
<br>
# From Loc Policy<br>
#loc loc ACCEPT<br>
#loc $FW ACCEPT<br>
#loc dmz REJECT info<br>
#loc net ACCEPT info<br>
<br>
# THE FOLLOWING POLICY MUST BE LAST<br>
all all REJECT info<br>
<br>
<br>
Thanks<br>
Indy<br>
<br>
<br>
On 10/10/2011 12:09 PM, Giuliano Natali wrote:
<blockquote
cite="mid:bfaaadc7750ba3bd1e1c2fa4afaaf3a9.squirrel@www.openit.it"
type="cite">
<pre wrap="">Alessandro Briosi wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Il 09/10/2011 17:07, Inderjit Singh ha scritto:
</pre>
<blockquote type="cite">
<pre wrap="">Hello ,
We are using shorewall with Proxmox. Issue is *net to FW* traffic not
working but *dmz to FW* is working fine. Our requirement is all
traffic goes to *Net to FW* . Please provide suggestions.
</pre>
</blockquote>
<pre wrap="">
Imho the rule
net all DROP
must be put after the
net $FW ACCEPT
net log REJECT
Otherwise it's applied before.
</pre>
</blockquote>
<pre wrap="">
I think the best way to use shorewall is to
write a policy like
all all DROP info (if you want to see where is the block)
and use the rules to enable the traffic between what you want
Then test the connection
if shorewall blocks a packet you will find a log like this
shorewall: dmz2net DROP etc. etc
Use this to write the rule
My additional cent to alessandro :-)
Diaolin
_______________________________________________
pve-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:pve-user@pve.proxmox.com">pve-user@pve.proxmox.com</a>
<a class="moz-txt-link-freetext" href="http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-user">http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-user</a>
</pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">
</pre>
</body>
</html>