In some email I received from Beers, James W., sie wrote:
> Darren,
>
> I understand why it is there and am glad that it is because I don't want to
> deal with file sharing connections that don't time out. Is there any way I
> can run with LARGE_NAT defined and still use the 'age' option with a MAPing
> in ipnat.conf? My suggestion was the only one that I could think of off the
> top of my head. The only other way around the problem that I can see is to
> change the code so that:
>
> <psuedo-code on>
> if LARGE_NAT is defined
> if there is an age parameter, set it to the age parameter
> if not age parameter, set it to the 10 minute default
> <psuedo-code off>
This makes a lot of sense. Try the patch below.
Darren
Index: ip_nat.c
===================================================================
RCS file: /devel/CVS/IP-Filter/ip_nat.c,v
retrieving revision 2.37.2.74
diff -c -r2.37.2.74 ip_nat.c
*** ip_nat.c 2002/12/06 11:40:21 2.37.2.74
--- ip_nat.c 2003/02/19 12:21:09
***************
*** 2510,2516 ****
if (nat->nat_age < fr_defnaticmpage)
nat->nat_age = fr_defnaticmpage;
#ifdef LARGE_NAT
! else if (nat->nat_age > fr_defnatage)
nat->nat_age = fr_defnatage;
#endif
/*
--- 2510,2517 ----
if (nat->nat_age < fr_defnaticmpage)
nat->nat_age = fr_defnaticmpage;
#ifdef LARGE_NAT
! else if ((!np || !np->in_age[1]) &&
! (nat->nat_age > fr_defnatage))
nat->nat_age = fr_defnatage;
#endif
/*
***************
*** 2731,2737 ****
if (nat->nat_age < fr_defnaticmpage)
nat->nat_age = fr_defnaticmpage;
#ifdef LARGE_NAT
! else if (nat->nat_age > fr_defnatage)
nat->nat_age = fr_defnatage;
#endif
/*
--- 2732,2739 ----
if (nat->nat_age < fr_defnaticmpage)
nat->nat_age = fr_defnaticmpage;
#ifdef LARGE_NAT
! else if ((!np || !np->in_age[0]) &&
! (nat->nat_age > fr_defnatage))
nat->nat_age = fr_defnatage;
#endif
/*
