My old Asus router died a few weeks ago, so I thought I'd set up my Debian box to deal with routing my home network. I have a few complications, but I adapted my configuration from a previously working configuration, and I don't see why I am having intermittent problems. But I am having them! Every so often, my SSH connections to the router (and to the Xen virtual machines hosted by the router) just drop. I am unable to use the router's dns server. I can't ping the router. Etc. All of these things work most of the time, but break down intermittently, for a few minutes at a time. (I can provide more details, but I'm not sure what will be helpful)
/etc/network/interfaces:
# The loopback network interface
auto lo
iface lo inet loopback
# Gigabit ethernet, internal network
auto eth0
allow-hotplug eth0
iface eth0 inet manual
# USB ethernet, internet
auto eth1
allow-hotplug eth1
iface eth1 inet dhcp
# Xen Bridge
auto xlan0
iface xlan0 inet static
bridge_ports eth0
address 10.47.94.1
netmask 255.255.255.0
As I understand it, this is sufficient to create the network interfaces, and even do some switching between Xen hosts and my eth0 interface. I installed and configured Shorewall to manage routing between the bridge and my internet-facing interface:
/etc/shorewall/zones
fw firewall
net ipv4
lan ipv4
/etc/shorewall/interfaces
net eth1 detect dhcp,tcpflags,nosmurfs,routefilter,logmartians
lan xlan0 detect dhcp,tcpflags,nosmurfs,routefilter,logmartians,routeback,bridge
/etc/shorewall/policy
net all DROP info
fw net ACCEPT info
all all REJECT info
/etc/shorewall/rules
DNS(ACCEPT) fw net
DNS(ACCEPT) lan fw
Ping(ACCEPT) lan fw
... and so on, these all work, when the router is accepting traffic at all.
/etc/shorewall/masq
eth1 10.47.94.0/24
Also, the router is currently "working", and I checked on a problematic client:
arp infrastructure
infrastructure.mydomain (10.47.94.1) at 0:23:54:bb:7d:ce on en0 ifscope [ethernet]
I tried it when the router was down, and I (eventually) got the same response. It took about 30 seconds to return, though.
