Bridge and OpenVPN with shorewall
- by Javier Martinez
I have this scenario and everything it's working OK, but I want to configure my Shorewall and I can't do it.
My interfaces are:
br0 (bridge of eth0)
tun0 (OpenVPN)
vnet* (each one of bridged interfaces with public IP's)
Public Main IP: 188.165.X.Y
OpenVPN IP's: 172.28.0.x
Bridge: public ip's
So, I have the next configuration for shorewall:
/etc/shorewall/zones
#ZONE TYPE OPTIONS IN OUT
# OPTIONS OPTIONS
fw firewall
inet ipv4
road ipv4
/etc/shorewall/interfaces
#ZONE INTERFACE BROADCAST OPTIONS
inet br0 detect routeback
road tun+ detect routeback
/etc/shorewall/policy
#SOURCE DEST POLICY LOG LIMIT: CONNLIMIT:
# LEVEL BURST MASK
$FW all ACCEPT
inet $FW DROP info
road all DROP
inet road DROP
/etc/shorewall/tunnels
#TYPE ZONE GATEWAY GATEWAY
# ZONE
openvpnserver:1194 inet 0.0.0.0/0
The problem is that even with shorewall running I am able to ping or connect to the virtual machines behind the bridge