Re: Shorewall with OpenVPN Hub and Spoke

Hi Tuomo,

> You can change this behaviour by changing vpn-vpn policy in policy
> file. Default policy in shorewall is ACCEPT for inter-zone traffic.

I assume you are referring to the policy file.  If so, mine contains:

$FW     net             ACCEPT
net     all             DROP            #$LOG_LEVEL
vpn     all             REJECT          $LOG_LEVEL
all     all             REJECT          $LOG_LEVEL

The second last line to drop VPN traffic was added to test if the firewall was having any affect.  What I found was that with routeback and even with that policy to reject VPN traffic it is still allowed.  

I am familiar with this configuration, I had it working before on an older system that that was lost due to a hard rive crash.  I also ots of experience with Shorewall.  The only difference is this time I am using Debian instead of Ubuntu and it seems like routeback is not behaving as it did in the past.

Simon