Hi,
Sorry if I wasn't too clear. The server that I want to show up on machines choosers
is running ipfilter .
I tried removing the keep state and allowing udp connections in:
pass in quick on hme0 proto udp from any port = 177 to 129.94.163.184/32
pass out quick on hme0 proto udp from any to 129.94.163.184/32 port = 177
but it still didn't turn up on the chooser screens, however, if I went the whole hog and let any udp connections
it would then broadcast and show up on peoples chooser screen.
pass in on hme0 proto udp from any to any
Can anyone suggest how I can control this a little better? That is how do I modify that line
to say only machine on my LAN can connect to any udp port on my machine (Ie all machines
in the networks 129.94.162.0 and 129.94.163.0)
I tried
pass in on hme0 proto udp from 129.94.163.0/32 to any
but it disappeared from the chooser. Maybe I should just find a good manual and sit down and read it and try and understan ipfilter more, but for now it is showing up on the choosers which is fine.
I watched with ipfstat -t while I was fiddling with all this and the only connections I could see were my ssh ones.
Even when it was showing up on the chooser I couldn't see any other connections to ports on my machine.
Thanks to everyone for their help,
Melinda
At 12:26 PM 6/02/2003 +0000, you wrote:
<snip>
> "however now due to the increasing number of users I would just like the
> server to broadcast to the network."
>
> Maybe I'm misreading this, it is somewhat unclear.
It is: does she mean the X server (client machines) or the servers
that are providing service.
Reading further I *think* that the IPFilter firewall may be
running on the machine that is providing service to the X
terminals. If this *is* the case then she should add rules to
allow the server to receive broadcasts (without "keep state"!)
*and* (if necessary) allow 177/udp *out*. Antony Riley's
explanation of the broadcast XDMCP case is correct and these
additions should allow the broadcast case to work *if it's
all local traffic*. The IP addresses in the original message
imply it probably is local unless there are unusual netmasks.
> > > I have no idea why this would ever work through a router, unless the
> > > router is forwarding network broadcasts (which is generally a bad thing).
The only thing I can think of in this case would be to run
an X chooser on the router.
> > I'd agree in the first case. In the second case it *should*
> > work through a router. A straightforward UDP "keep state"
> > rule shoudl allow the XDMCP packets through. Once the XDMCP
> > negotiation(s) are complete, the server will need to display
> > a login window on the client which is a X11 call from the
> > server to port 6000 on the client.
>
> The port 6000 stuff is not relavent to the question, as the computers are not
> appearing on the chooser.
Just completing what needs to be there for the directed cast to work.
> Keep state will not work, if the query is sent to the broadcast address, as
> the reply will not be from the broadcast address, but from the machine that
> is replying.
In the broadcast case, I agree. In the unicast case it would (work).
--
David Pick
