The 3.20.168.160/27 is routed to a firewall running shorewall. Behind the firewall is an OpenStack cluster running a neutron l3 agent and known to the firewall as 192.168.25.221. A parallel zone is defined as follows:
diff -r 34984beb770d hosts
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/hosts Wed Nov 20 14:59:09 2013 +0100
@@ -0,0 +1,1 @@
+opens eth0:3.20.168.160/27
diff -r 34984beb770d policy
--- a/policy Wed Jun 05 00:19:12 2013 +0200
+++ b/policy Wed Nov 20 14:59:09 2013 +0100
@@ -113,6 +113,7 @@
# If you want to force clients to access the Internet via a proxy server
# on your firewall, change the loc to net policy to REJECT info.
loc net ACCEPT
+loc opens ACCEPT
loc $FW ACCEPT
loc all REJECT info
@@ -124,6 +125,7 @@
# This may be useful if you run a proxy server on the firewall.
#$FW net REJECT info
$FW net ACCEPT
+$FW opens ACCEPT
$FW loc ACCEPT
$FW all REJECT info
@@ -132,6 +134,7 @@
#
net $FW DROP info
net loc DROP info
+net opens ACCEPT
net all DROP info
# THE FOLLOWING POLICY MUST BE LAST
diff -r 34984beb770d zones
--- a/zones Wed Jun 05 00:19:12 2013 +0200
+++ b/zones Wed Nov 20 14:59:09 2013 +0100
@@ -115,5 +115,6 @@
fw firewall
net ipv4
loc ipv4
+opens ipv4
and net incoming packets are accepted for the subnet when targeting the loc zone which contains the 192.168.25.0/24 subnet:
ACCEPT net loc:3.20.168.163/27
A route is added
ip r add 3.20.168.160/27 via 192.168.25.221
A ping from the firewall will show on the destination interface
# tcpdump -i eth0 -n host 3.20.168.163
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
15:03:29.258592 IP 192.168.25.253 > 3.20.168.163: ICMP echo request, id 48701, seq 1, length 64
even if it timesout because the IP is not actually there
# ping -c 1 3.20.168.163
PING 3.20.168.163 (3.20.168.163) 56(84) bytes of data.
--- 3.20.168.163 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms
The subnet must be excluded from the masquerading rules by setting /etc/shorewall/masq as follows:
eth1 eth0!3.20.168.160/27
which says to masquerade all but the subnet that is transparently routed. The result can then be checked from a virtual machine to which an IP has been routed with:
# wget --quiet -O - http://bot.whatismyipaddress.com ; echo
3.20.168.169