NethServer 6

The problem seems to be caused by rtrules:

0: from all lookup local 
999: from all lookup main 
1900: from 192.168.1.1 lookup itcpr 
10000: from all fwmark 0x10000/0xf0000 lookup itcpr 
10001: from all fwmark 0x20000/0xf0000 lookup itcsc 
.
.
.
32765: from all lookup balance 
32767: from all lookup default 

the rule

1900: from 192.168.1.1 lookup itcpr

has a too high priority and all the packets from 192.168.1.1 are sent to the alias interface even if the connection is from outside.

I would like that only new connections from local host 192.1681.1 are forced to the ethx interface of the alias, other connections should follow standard rules,
to have this behavior it should be enough to have a lower priority for snat rules.

0: from all lookup local 
999: from all lookup main 
10000: from all fwmark 0x10000/0xf0000 lookup itcpr 
10001: from all fwmark 0x20000/0xf0000 lookup itcsc 
11000: from 192.168.1.1 lookup itcpr 
.
.
.
32765: from all lookup balance 
32767: from all lookup default 

It can be done easily with this little change:

[root@nethserver ~]# diff -u 30nat.ori  /etc/e-smith/templates/etc/shorewall/rtrules/30nat 
--- 30nat.ori   2015-10-07 16:44:48.039206391 +0200
+++ /etc/e-smith/templates/etc/shorewall/rtrules/30nat  2015-10-07 16:37:39.867472712 +0200
@@ -24,7 +24,7 @@
             foreach $j (@providers) {
                 my $provider_name = $j->{'name'};
                 if($j->{'interface'} eq $interface) {
-                    $OUT .= "$internal_ip\t\t-\t\t\t$provider_name\t\t1900\n";
+                    $OUT .= "$internal_ip\t\t-\t\t\t$provider_name\t\t11000\n";
                 }
             }
         }

I already checked it and it seems to work fine without any drawback.