[ILUG] Shorewall gurus: Connection redirect problem

[Kenn Humborg]

> Even though you can direct traffic from external-to-external, unless
> it's usng a local proxy like balance, the response will fly directly
> from the external server to the client, and so arriving out-of-context.

I know about that.  That's why I have an SNAT rule to re-write
the source addr of the forwarded packets so that responses
come back to the forwarding box and conntrack de-NAT them
back to the original client.

I've worked around the problem by adding this to 
/etc/shorewall/start:

   run_iptables -t filter -A eth0_fwd -o eth0    \
      -m policy --dir out --pol none -j net2net

But I'm sure there is a more "proper" way to do this.

Later,
Kenn