Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Internet connectivity through my 12.04 LTS shorewall box is spotty at best. Ping works both locally and to the internet with no dropped packets (from both the box itself and internal LAN). HTTP connections work great through squid, but when I don't use squid they are slow and spotty. SSH is also slow and sometimes connecting can be difficult. HTTPS and email don't work at all.

This box is replacing an 11.04 box with the same setup that worked fine. It's a fresh install of 12.04 LTS on new hardware.

Network config:

% ifconfig
eth0      Link encap:Ethernet  HWaddr bc:5f:f4:47:99:24  
          inet addr:X.X.X.X  Bcast:  Mask:
          RX packets:36215 errors:2882 dropped:0 overruns:0 frame:2882
          TX packets:6652 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:2983691 (2.9 MB)  TX bytes:660681 (660.6 KB)

eth1      Link encap:Ethernet  HWaddr bc:5f:f4:47:99:22  
          inet addr:  Bcast:  Mask:
          inet6 addr: fe80::be5f:f4ff:fe47:9922/64 Scope:Link
          RX packets:5875 errors:0 dropped:9 overruns:0 frame:0
          TX packets:4424 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:661913 (661.9 KB)  TX bytes:762000 (762.0 KB)

lo        Link encap:Local Loopback  
          inet addr:  Mask:
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:18 errors:0 dropped:0 overruns:0 frame:0
          TX packets:18 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1284 (1.2 KB)  TX bytes:1284 (1.2 KB)

I don't think it's a routing issue:

% route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         X.X.X.X         UG    100    0        0 eth0        *        U     0      0        0 eth1
X.X.X.0         *        U     0      0        0 eth0

I've enabled IP forwarding:

% sudo sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1

I've tried with rp_filter on and off with the same results.

I've tried specifically adding a rule to shorewall to allow traffic through on 80 and 443, but it didn't fix it (and shouldn't be necessary with the given policy).

Shorewall config is as follows:

% grep -v ^# /etc/shorewall/interfaces
net eth0  detect  dhcp
loc eth1  detect  dhcp

% grep -v ^# /etc/shorewall/zones
fw  firewall
net ipv4
loc ipv4

% grep -v ^# /etc/shorewall/rules
Ping(ACCEPT)  fw  loc

% grep -v ^# /etc/shorewall/policy

fw  fw  ACCEPT  info
fw  net ACCEPT  info
fw  all REJECT  warning

loc fw  ACCEPT  info
loc net ACCEPT  info

net fw  REJECT  notice
net loc DROP  error

all all REJECT  info

% grep -v ^# /etc/shorewall/masq

Relevant iptables:

% sudo iptables -L

Chain net2loc (1 references)
target     prot opt source               destination         
dynamic    all  --  anywhere             anywhere             ctstate INVALID,NEW
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
Drop       all  --  anywhere             anywhere            
LOG        all  --  anywhere             anywhere             LOG level error prefix "Shorewall:net2loc:DROP:"
DROP       all  --  anywhere             anywhere            

% sudo iptables -t nat -L -v -n

Chain POSTROUTING (policy ACCEPT 116 packets, 8749 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  189 12557 eth0_masq  all  --  *      eth0             

Chain eth0_masq (1 references)
 pkts bytes target     prot opt in     out     source               destination         
   73  3808 MASQUERADE  all  --  *      * 

Everything looks okay to my eyes.

I think it's a connection tracking issue, but I'm not sure how to go about diagnosing it, much less fix it. Any help is greatly appreciated.

share|improve this question

1 Answer 1

You need to enable ip forwarding from inside shorewall

sudo nano /etc/shorewall/shorewall.conf

then find the line IP_FORWARDING=keep and change this to On:


Save and exit the file, then run:

sudo shorewall restart
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.