Tomasz, Thank you for your response.
I have defined LARGE_NAT and made these modifications to the following parameters in ip_nat.h: #define NAT_SIZE 8191 #define RDR_SIZE 8191 #define NAT_TABLE_SZ 262143 #define HOSTMAP_SIZE 32767 I also modified the following parameters in ip_state.h: #define IPSTATE_SIZE 64997 #define IPSTATE_MAX 45499 /* Maximum number of states held */ Both of these modifications were made in anticipation of expected traffic load that this firewall will need to handle. Right now, I have tcp/udp high ports blocked so that our students cannot access file sharing services (I know, these types of services can be accessed over port 80 as well as other well-known port below 1024, but most of our students don't realize that, yet. I also have a PacketShaper in place to manage the traffic once high ports are open, but I digress). I have also modified timeout parameters in ip_state.c so that the firewall does not have to keep track of the states as long as it would under the default install of ipf. After searching through the archives AND verifying what I found in the archives with the code in ip_nat.c, the 'problem' that I am experiencing is really how IPNAT'ing functions. If LARGE_NAT is defined, then the NAT mappings will time out after 10 minutes of INACTIVITY because LARGE_NAT forces the NAT code to impose a timeout of DEF_NAT_AGE, which is 10 minutes. I was hoping that the request for a variable NAT mapping age would be incorporated into ipfilter at some point. If I want all the different kinds of Internet-bound traffic to flow one central firewall, then I need this type of functionality. A work-around would be to install another firewall on the subnet where the users are experiencing the problem and lock it down so that only the traffic that is causing the problem would be routed to that firewall and all other traffic would flow through the central firewall. This is feasible because the traffic is destined for only one Internet host so I could make routing changes on the clients based on IP addresses. But, I would prefer not to do that because, well, it's more work, and if I don't have to do it, I'd rather not. I could also segregate out-going traffic by population type (students vs. employees), but that would require additional networking equipment and overall network reconfiguration (we currently use a collapsed backbone), which requires money. Hmmm, that is a continuing battle and I'll save it for another time. If I am missing something obvious here, please let me know. I had my head so buried in the details of the implementation of the new central firewall that I could be missing the forest for the trees. -jwb -----Original Message----- From: Tomasz Baranowski [mailto:[EMAIL PROTECTED]] Sent: Monday, February 10, 2003 7:00 PM To: [EMAIL PROTECTED] Subject: Re: IPNAT Age vs. IPFILTER Age On 2/10/03 6:24 PM, Beers, James W. wrote: > I'm experiencing a problem with an application and I believe that it > is due to the fact that a NAT entry times out before the state entry > in the ipfilter state table times out. The NAT age is set to the > default (10 minutes) and the ipfilter state timeout has been set to 1 > hour. [...] Did you define LARGE_NAT in ip_nat.h? I've had the same problem when I compiled IPFilter with LARGE_NAT. I've undefined LARGE_NAT and increased NAT_SIZE, RDR_SIZE, HOSTMAP_SIZE and NAT_TABLE_SZ. Greetings, Tomasz Baranowski
