Using Nethserver as Gateway Being Blocked on Green Network

NethServer Version: 7.7.1908
Module: Gateway

For some reason my Nethserver refuses to act as a Gateway for the green network. I have no firewall rules and from everything I’ve read, it should work out of the box.

It’s a very basic setup with 1 Green and 1 Red interface. But when I set my PC up to use the Nethserver as the gateway the logs report that it drops the connection:

Oct 29 22:14:45 gw kernel: Shorewall:sfilter:DROP:IN=ens224 OUT=ens224 MAC=00:0c:29:4b:03:be:00:0c:29:81:f9:4d:08:00 SRC= DST= LEN=52 TOS=0x02 PREC=0x00 TTL=127 ID=13078 DF PROTO=TCP SPT=55446 DPT=80 WINDOW=64240 RES=0x00 CWR ECE SYN URGP=0

I’m at a loss to understand why. From the Nethserver terminal I can ping the internet sites without issue.

The setup is as follows:

GW: (Red Network)

PC Setup:
GW: (Nethserver IP)

Are some rules I need to apply to the firewall to allow traffic through?



Red interface gets the IP of your Router/Provider as gateway. The green interface only gets an IP, no gateway. Your Client gets the IP of green interface as gateway.

Thanks Michael, but that made no difference. Any other suggestions?



Has anyone an idea?

Why the Gw is not the same one?

One the green side, ser the Gw as the green Nethserver ip adress!

Have you configure a dhcp server or not?

Hi Jim,

I have tried the GW on the same subnet eg, no difference. I have tried Michale’s suggestion as well with no GW.

I don’t need a DHCP server so haven’t configured one.

It’s reall weird. The Shorewall firewall is actively rejecting traffic. Here is another example:

Oct 30 08:15:28 gw kernel: Shorewall:net2fw:DROP:IN=ens224 OUT= MAC=00:0c:29:4b:03:be:64:d1:54:1b:a9:e9:08:00 SRC= DST= LEN=83 TOS=0x00 PREC=0x00 TTL=60 ID=35558 DF PROTO=TCP SPT=443 DPT=46974 WINDOW=247 RES=0x00 ACK PSH FIN URGP=0
Oct 30 08:15:33 gw kernel: Shorewall:net2fw:DROP:IN=ens224 OUT= MAC=00:0c:29:4b:03:be:64:d1:54:1b:a9:e9:08:00 SRC= DST= LEN=64 TOS=0x00 PREC=0x00 TTL=60 ID=35559 DF PROTO=TCP SPT=443 DPT=46974 WINDOW=247 RES=0x00 ACK URGP=0
Oct 30 08:15:35 gw kernel: Shorewall:net2fw:DROP:IN=ens224 OUT= MAC=00:0c:29:4b:03:be:64:d1:54:1b:a9:e9:08:00 SRC= DST= LEN=40 TOS=0x00 PREC=0x00 TTL=114 ID=19380 DF PROTO=TCP SPT=443 DPT=39814 WINDOW=0 RES=0x00 ACK RST URGP=0

This happens I assume when you try and surf to those locations. Weird…

So the red card has it’s ip adress with is or an ip ISP dhcp client or a fixed one, with the gw given bu the ISP

Tgreen nic is your internal network, but without dhcp,
Bit have you configure a dns, to Nethserver knowing what to do.

If I remember, it’s dnsmask to do the job

Hi Jim,

The Red card is a static IP I applied to it of the red card is also a static IP of and it connects to the Mikrotik router which has as the address.

Examples I’ve tried:

Using the the Gateway and DNS of both the Mikrotik and Nethserver itself. Also, using the Gateway of the Mikrotik and the Nethserver.

When I ping any address from the Nethserver Terminal it resolves and returns the correct IP to any DNS query.

On The PC:
When I use the Gateway as the Nethserver with any of the configs above, the internet is either super slow to receive web pages or times out.

I can use the Mikrotik as the Gateway on the PC and the internet is really responsive and no issues at all surfing.

So something I’ve done or neglected to do is preventing me from using the Nethserver as the GW. When I do a speed test on the Nethserver I get 70 down and 30 Up, so the connectivity is not the issue.

I’m at a loss of what to do next.

Thanks for your patience and understanding with this…


The Nethserver has one or two Nics?
I have dificulty to determine this point? The way you explain it seem like one Nic with two adresses

It has 2 nics. One dedicated to green and the other red.

When you connect the pc on the green, you can ping the green nic?
The red nic? The Microtik?

Ping results are as follow when I use the Mikrotik ( as the Gateway I can ping everything without issue.

When I use Nethserver ( as the gateway, I can ping everything including the Mikrotik Gateway, but it seems a bit random and pinging will give mixed results with time out being experienced more often than not, so it’s definitely Nethserver blocking the route to the Mikrotik.

Let me try to visualize your situation:
external IP Mikrotik
Mikrotik Router
Internal IP Mikrotik: (GW for NS RED interface)
external IP NS RED interface
Internal IP NS GREEN interface: (GW for rest of your LAN clients)
Switch to rest of your LAN

Can you doublecheck you connected RED and GREEN interfaces correctly? (RED to Mikrotik and GREEN to LAN Switch)

You didn’t accidentally connect both RED and GREEN to the MikroTik router did you?

Can you access NS from a LAN client? (through the GREEN interface)
Can you reach the NS RED interface from a LAN client?
Can you reach the Mikrotik router from NS?
Can you reach the Mikrotik router from a LAN client?
What happens if you (temporarily) disable Shorewall? Do you have access to outside from a LAN client?
What device(es) are DHCP server? and what IP ddresses do they give out.

1 Like

Hi Rob,

I think I’ve figured it out. I’ve tested at another location and it works flawlessly.

At this other location I could dedicate a port on the Mikrotik to both the RED and GREEN interfaces, whereas at the test site I had to share a port for RED and GREEN and I think that was causing some issue even though I could ping it and on the surface looked like it would work.

I do apologise for wasting your time, it was unintended because I’m so green using Nethserver.

Thanks for all your advise.



So basically you tried to connect RED and GREEN to the same subnet…
I had a small suspicion that was the case…

No, they were on the different subnets, but I tried to do some fancy multi-homed shared port setup where the port that did the green subnet on the Mikrotik was also masquerading as the red subnet for the Nethserver. This was because I had no more ports available on the Mikrotik to separate the two.

Although everything seemed to work because I could ping it and the Nethserver could see it and confirmed connection, it just couldn’t be routed I suppose.

What did I learn from this? Stop trying to be a smart arse… :wink:

Once again, thanks for your patience with me.

1 Like