Gateway and Internet Routing

[LansITGuy]

Hi all.

 

Bit of a last resort on this one. I've been banging my head against the desk for a few days and I just can't wrap my head around why this doesn't work. As a bit of a disclaimer, I'm not used to setting up firewalls and Linux, so this is probably user error somewhere.

 

Setup:

All machines mentioned below are VMs and switching is HP Procurve. Filtering is provided by BT Lancashire's remote Lightspeed system. Both VMs reside on the same physical host and access the same physical VMware network links.

 

Original Gateway Setup.

This was installed by a contractor a few years ago.

Smoothwall Express sits on a VM.

DHCP sets client gateway to core switch.

Core switch gateway set to Smoothwall Express internal IP.

Smoothwall Express external IP links to Lightspeed - all works fine.

 

New Gateway Setup

Ubuntu Server running Shorewall in a VM.

DHCP sets client gateway to core switch.

Core switch gateway set to new Ubuntu VM internal IP.

Ubuntu VM external links to Lightspeed

 

Now the new system works fine. I can see a change of external IP in the Lightspeed logs as each VM external adapter has a different IP. However, as soon as I turn off the Smoothwall VM the Internet grinds to a halt. Pages do load but they take about 10 seconds longer.

 

With the new setup in place I can traceroute and see that we are not going via the Smoothwall link even when it is powered off. So why if we're not going through the Smoothwall VM does it have to be on?

 

Not sure if anyone could help here, but any ideas are more than welcome.

 

Thanks in advance.

[ChrisH]

Is it to do with DNS forwarding?

[LansITGuy]

Thanks Chris.

 

This is what I was thinking earlier in the week. I have the DNS servers configured on the external network adapter of the VM and DNS to / from the firewall has access to the net. I'm trying to find if there is a specific setting in the Shorewall documentation that I'm missing but so far I'm having no luck (that isn't to say it isn't there somewhere).

 

Cheers.

[ChrisH]

I was thinking more that your server DNS might be using the Smoothwall as a forwarder.

[LansITGuy]

Chris, you Sir, are a genius!

 

I remember seeing the LCC DNS servers in there, but hadn't spotted the link back to the Smootwall Express IP. Good spot and thank you so much for your help!

 

This is an interesting learning curve.

Cheers!

[ChrisH]

No problem, the same issue has caught me out a few times and that is why it was in the forefront of my mind.