Hi,
I've read many examples and cannot make a generic tcp proxy redirect work. Here's what I'm trying to do in the ipnat.conf file:
rdr bge0 0.0.0.0/0 port ftp -> 198.77.116.127 port ftp tcp rdr bge0 0.0.0.0/0 port 74111 -> 172.23.66.58 port 74111 tcp # map bge0 0.0.0.0/0 -> 172.23.66.58/32 proxy port 74111 74111/tcp map bge0 0.0.0.0/0 -> 198.77.116.127/32 proxy port ftp ftp/tcp
The ftp works fine and dandy, but the custom port 74111 fails with this error:
# /etc/init.d/ipfboot reload Set 1 now inactive filter sync'd 2 entries flushed from NAT table 3 entries flushed from NAT list syntax error error at "74111", line 12 /etc/init.d/ipfboot: load of /etc/opt/ipf/ipnat.conf failed
Note that when I load it (without the proxy map) and then run:
a34-dash-01# ipnat -slv mapped in 231 out 228 added 31 expired 0 no memory 0 bad nat 11 inuse 1 rules 6 wilds 0 table ffffffff7ffffb28 list 30002a719b0 List of active MAP/Redirect filters: rdr bge0 0.0.0.0/0 port 21 -> 198.77.116.127 port 21 tcp rdr bge0 0.0.0.0/0 port 8575 -> 172.23.66.58 port 8575 tcp map bge0 0.0.0.0/0 -> 198.77.116.127/32 proxy port ftp ftp/tcp
It shows up as port 8575!
So after a few iterations, I set it to port 112647 at is comes out to port 47111. Then the redirect works on port 47111, but I still need a proxy. Strange...
This is on Solaris 9, Sun Sparc V240.
a34-dash-01# netstat -s -P ip
IPv4 ipForwarding = 1 ipDefaultTTL = 255
ipInReceives = 13279 ipInHdrErrors = 0
ipInAddrErrors = 0 ipInCksumErrs = 0
ipForwDatagrams = 257 ipForwProhibits = 0
ipInUnknownProtos = 0 ipInDiscards = 0
ipInDelivers = 8955 ipOutRequests = 7905
ipOutDiscards = 0 ipOutNoRoutes = 0
ipReasmTimeout = 60 ipReasmReqds = 0
ipReasmOKs = 0 ipReasmFails = 0
ipReasmDuplicates = 0 ipReasmPartDups = 0
ipFragOKs = 0 ipFragFails = 0
ipFragCreates = 0 ipRoutingDiscards = 0
tcpInErrs = 0 udpNoPorts = 3290
udpInCksumErrs = 0 udpInOverflows = 0
rawipInOverflows = 0 ipsecInSucceeded = 0
ipsecInFailed = 0 ipInIPv6 = 0
ipOutIPv6 = 0 ipOutSwitchIPv6 = 15a34-dash-01# ipf -V ipf: IP Filter: v4.1.3 (592) Kernel: IP Filter: v4.1.3 Running: yes Log Flags: 0 = none set Default: pass all, Logging: available Active list: 0 Feature mask: 0x187
a34-dash-01# ipfstat -io pass out quick on lo0 all pass out log quick on bge0 all pass in quick on lo0 all pass in log quick on bge0 all
a34-dash-01# ipfstat bad packets: in 0 out 0 IPv6 packets: in 0 out 0 input packets: blocked 0 passed 13369 nomatch 0 counted 0 short 0 output packets: blocked 0 passed 8227 nomatch 0 counted 0 short 0 input packets logged: blocked 0 passed 13365 output packets logged: blocked 0 passed 8223 packets logged: input 0 output 0 log failures: input 87 output 91 fragment state(in): kept 0 lost 0 not fragmented 0 fragment state(out): kept 0 lost 0 not fragmented 0 packet state(in): kept 0 lost 0 packet state(out): kept 0 lost 0 ICMP replies: 0 TCP RSTs sent: 0 Invalid source(in): 0 Result cache hits(in): 5647 (out): 5662 IN Pullups succeeded: 0 failed: 0 OUT Pullups succeeded: 12 failed: 0 Fastroute successes: 0 failures: 0 TCP cksum fails(in): 0 (out): 0 IPF Ticks: 20397 Packet log flags set: (0) none
Thanks,
Karl
