I have a two-interface shorewall config that is working fine.

My local network has grown and I need to add a router inside the local zone. It would be easy to add another nic to the firewall - but I can't do this. I must add a router inside the local zone and have the firewall route to the new subnet via the new router.

The "multiple-zones" howto says I can do this by telling shorewall to "add a route to the new subned via the router and restarting shorewall"... alas - for the life of me I cannot find anywhere that describes how to add a static route in a shorewall config!!

In essence, this is a similar problem to adding a NATing wireless router onto a home network. (because this also adds a new subnet onto the local zone). This must have been solved many times in the past.

Can anybody help explain to me?
Thanks

I think what you need to do is to add a static route, not in shorewall, but in the linux networking. You can do this either via the Administration-Network GUI, if you are running a windowed environment, or via the "route" command if you are in a terminal window (need root password, either way)

The reason for this is that the router running shorewall has to know that, to get to subnet "a" (the new subnet), it has to pass traffic *through* subnet "b" (the old subnet), and that's a routing function, not a firewall function

HTH

JB

Thanks for the tip. I guess this is kind of obvious and I should have been able to work it out.

My mistake was to assume that, having spent days and days working out how to customise the shorewall scripts to do all sorts of cool things like traffic shaping and prioritisation and pinholing and the like for the local subnet, I assumed youd also use these scripts to define routing.

Hmmmm.. I should think of trying the obvious in future. ;-)