[Shorewall-users] Weird issue with DNAT. Not working at times

[Guillermo Cediel Blanco]

Hi,

I have installed shore wall 5.0.8 on a CentOS 7 server, and I’m having a weird issue with DNAT.

The server running shorewall has three network interfaces:

real eno16777984
dmz eno33557248
wan eno50336512 routefilter,blacklist,tcpflags,logmartians,nosmurfs

real is our internal network, wan is internet and dmv is a network where I have installed a https server that must have accesible from internet. The following are my zones:

fw firewall
wan ipv4
real ipv4
dmz ipv4
dev ipv4

I have defined the masq file as (the public ip address has been masked):

eno50336512 10.58.80.0/24,\
10.210.54.0/24 xx.xx.xx.xx

10.58.80.0/24 is the real subnet, and 10.201.54.0 is the dmz subnet. The DNAT rules created in the rules file are:

DNAT wan dmz:10.210.54.10 tcp 443 - xx.xx.xx.xx
ACCEPT all dmz:10.210.54.10 tcp 443

Well, DNAT is usually working from internet; I can access the server without problems, but I’ve found that from time to time, server is not accesible from internet. If I try to test the connection with the command:

telnet xx.xx.xx.xx 443

I don’t get any response from the server. However, while there’s no connection from internet, I can connect to the server from the ‘real’ network (accessing to the IP address 10.210.54.10). I think this means that it’s a problem related to the DNAT rules.

This situation lasts for some minutes, and then it works again. I have tried the solution stated here: http://documents.made-it.com/iptables-timeout.html <http://documents.made-it.com/iptables-timeout.html> in case it was a problem related with the TCP keep alive settings, but with no luck.

Any suggestions?

If you need some additional information, please ask for it.

Thanks in advance.



Guillermo

[Tom Eastep]

Hi,
I have installed shore wall 5.0.8 on a CentOS 7 server, and I’m
having a weird issue with DNAT.
realeno16777984 dmzeno33557248
waneno50336512routefilter,blacklist,tcpflags,logmartians,nosmurfs
real is our internal network, wan is internet and dmv is a network
where I have installed a https server that must have accesible from
fwfirewall wanipv4 realipv4 dmzipv4 devipv4
eno5033651210.58.80.0/24,\ 10.210.54.0/24xx.xx.xx.xx
10.58.80.0/24 is the real subnet, and 10.201.54.0 is the dmz
DNATwandmz:10.210.54.10tcp443- xx.xx.xx.xx
ACCEPTalldmz:10.210.54.10tcp443
Well, DNAT is usually working from internet; I can access the
server without problems, but I’ve found that from time to time,
server is not accesible from internet. If I try to test the
telnet xx.xx.xx.xx 443
I don’t get any response from the server. However, while there’s
no connection from internet, I can connect to the server from the
‘real’ network (accessing to the IP address 10.210.54.10). I think
this means that it’s a problem related to the DNAT rules.
This situation lasts for some minutes, and then it works again. I
http://documents.made-it.com/iptables-timeout.html in case it was a
problem related with the TCP keep alive settings, but with no
luck.
Any suggestions?

When this happens, I suggest that you follow the DNAT troubleshooting
steps in Shorewall FAQs 1a and 1b. Note, however, that once 'shorewall
start' or 'shorewall restart' completes, there is no Shorewall code
running in your system at all. So as far as the ruleset goes, DNAT is
either going to work or it isn't. Hence, with TCP, the most likely
reason that DNAT would stop working is that the requests aren't
reaching the firewall or that something else (such as another firewall
package) has modified the Netfilter configuration.

- -Tom
- --
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________