我已经安装并配置了两个ISP的Shorewall。我想提供对客户端的Internet访问以及服务器连接和NAT的其他连接。
我可以从客户端区域和DMZ区域导航，但我无法使用LAN外部服务器的服务。我在两个站点（局域网和局域网）中嗅探了数据包，我看到DMZ中的服务器收到NATed数据包并回答它们，但似乎数据包没有返回到外部客户端。
谁能帮我？这些是我安装的配置文件：
> cat interfaces
#ZONE INTERFACE BROADCAST OPTIONS
net eth0 detect dhcp,routeback,blacklist,tcpflags,nosmurfs,routefilter,logmartians
net eth1 detect dhcp,routeback,blacklist,tcpflags,nosmurfs,routefilter,logmartians
loc eth2 detect dhcp,routeback,blacklist,tcpflags,nosmurfs,routefilter,logmartians
dmz eth3 detect dhcp,routeback,blacklist,tcpflags,nosmurfs,routefilter,logmartians
> cat zones
#ZONE TYPE OPTIONS IN OUT OPTIONS OPTIONS
fw firewall
net ipv4
loc ipv4
dmz ipv4
> cat providers
#NAME NUMBER MARK DUPLICATE INTERFACE GATEWAY OPTIONS COPY
ADSL2 2 0x2 main eth1 8x.xx.1x7.1 track,balance eth2,eth3
ADSL1 1 0x1 main eth0 8y.yy.2y1.2 track,balance eth2,eth3
> cat mask
#INTERFACE SOURCE ADDRESS PROTO PORT(S) IPSEC MARK
eth0 8y.yy.2y1.yy6 8x.xx.1x7.xx2
eth0 eth2 8y.yy.2y1.yy6
eth0 eth3 8y.yy.2y1.yy6
eth1 8x.xx.1x7.xx2 8y.yy.2y1.yy6
eth1 eth2 8x.xx.1x7.xx2
eth1 eth3 8x.xx.1x7.xx2
> cat rules
DROP:info net:192.168.0.0/24 all
DROP:info net:192.168.4.0/22 all
DNS(ACCEPT) $FW net:eth0
DNS(ACCEPT) dmz net:eth0
HTTP(ACCEPT) dmz net:eth0
HTTPS(ACCEPT) dmz net:eth0
ACCEPT net:eth0 dmz
DNAT net:eth0 dmz:192.168.0.252 tcp 80
Ping(DROP) net:eth1 $FW
Ping(DROP) net:eth0 $FW
Ping(ACCEPT) loc $FW
Ping(ACCEPT) loc dmz
Ping(ACCEPT) dmz loc
Ping(ACCEPT) dmz net:eth0
Ping(ACCEPT) dmz $FW
ACCEPT $FW loc icmp
ACCEPT $FW dmz icmp
SSH(ACCEPT) dmz $FW
> cat tcrules
#MARK SOURCE DEST PROTO DEST_PORT(S)
1:P 192.168.0.0/24 -
2:P 192.168.4.0/22 -
1 $FW