Bill Pringlemeir wrote: > On 2 Mar 2005, [EMAIL PROTECTED] wrote: > >> It seems that running GTKG on a box with ip forwarding would not be > >> a good idea. Probably the same for a web server, etc. > > Normally, you'd set up a static NAT route so that you don't need to > > track each single connection. > I am not really sure what a static NAT route is.
What I meant, was an ipnat rule like this: rdr pppoe0 0/0 port 6346 -> 10.0.0.2 port 6346 tcp/udp "rdr" means redirect, the rest should be more or less self-explanatory. In order to accept incoming TCP connection on machines behind the NAT router, such a redirect seems to be necessary with ipf in any case. For UDP that's not true and a "map" rule for portmapping would be sufficient to receive incoming UDP packets from a given host, as soon as you've sent a UDP packet to the remote host. In this case however, the NAT router needs to remember address and port in both directions and also manage a timeout for the dynamic route. > btw, why no SO_LINGER options? Couldn't a meany perform a DOS attack > on a GTKG node? I guess we are trying to be nice to other nodes? It doesn't seem to be recommended, often buggy implemented (as it's rarely used) and it does not really look TCP compliant. In how far would it be useful? Do you mean it would reduce or eliminate TIME_WAIT? -- Christian
pgpYAPEm2aFUn.pgp
Description: PGP signature
