---------- Original Message ---------------------------------- From: Clayton Fiske <[EMAIL PROTECTED]> Date: Wed, 4 Dec 2002 11:33:11 -0800
>On Wed, Dec 04, 2002 at 09:27:17PM +0200, Marko Havu wrote: >> We have a small address space with netmask 255.255.255.248. This leaves us >> only 5 usable IP addresses, so I'm trying to set up ipnat to map the >> addresses in a larger internal network into this range. I started with the >> following ruleset: >> map tu1 192.168.1.0/24 -> 0.0.0.0/32 proxy port ftp ftp/tcp >> map tu1 192.168.1.0/24 -> 0.0.0.0/32 portmap tcp/udp 40000:60000 >> map tu1 192.168.1.0/24 -> 0.0.0.0/32 >> >> None of the machines in the intenal network could access the external >> network, even though 'ipnat -l' shows mappings for connections to the >> external nameservers. I then tried to get one of the machines in the >> internal network to be visible in the external network by replacing the >> ruleset with just one rule: >> bimap tu1 192.168.1.2 -> x.x.x.x/32 >> >> Again, the gateway sees both networks as expected and 'ipnat -l' shows >> active mappings but nothing gets through either way. Is the machine in the >> internal network expected to answer to 'ping x.x.x.x' from the external >> network (are the ICMP packets forwarded)? I'm not sure whether the problem >> lies in ipnat or somewhere else as I was unable to get any routing done >> with gated either. The gateway is running IPFilter v4.0alpha25 on Tru64 >> UNIX V5.1A. > >Are you sure you don't have ipf rules blocking this traffic? Yes, I started with pass in all, pass out all. Even with some added rules ipfstat shows 0 blocked packets. - Marko
