On Thu, 11 Nov 2004, Karl Fosburg wrote:
> Hi, > > I've read many examples and cannot make a generic tcp proxy redirect > work. Here's what I'm trying to do in the ipnat.conf file: > > rdr bge0 0.0.0.0/0 port ftp -> 198.77.116.127 port ftp tcp > rdr bge0 0.0.0.0/0 port 74111 -> 172.23.66.58 port 74111 tcp > # > map bge0 0.0.0.0/0 -> 172.23.66.58/32 proxy port 74111 74111/tcp > map bge0 0.0.0.0/0 -> 198.77.116.127/32 proxy port ftp ftp/tcp > > The ftp works fine and dandy, but the custom port 74111 fails with this > error: > The ftp proxy is not a generic proxy. What we can't tell from the infromation provided is wether the application you are using at port 74111 uses commands very much like an FTP server. Putting aside your Redirect statements and looking at the NAT entries you have, an example of using the ftp proxy to service HylaFAX connections through the router you would use a rule like: map bge0 0.0.0.0/0 -> 172.23.66.58/32 proxy port 4559 ftp/tcp This would use the in-kernel FTP Proxy of IP Filter for outbound connections on bge0 destined to port 4559 and appear as having a source address of 172.23.66.58 You custom entry for 74111 implies that the NAT should use the in-kernel 74111 proxy. This would be your own code for the protocol you are using and would need to be integrated into the source code of IP Filter. You cannot however use tcp port 74111 because 65535 is the highest you can go. If your service running at the server is FTP like as HylaFAX is then you could try using the FTP proxy in IP Filter. > # /etc/init.d/ipfboot reload > Set 1 now inactive > filter sync'd > 2 entries flushed from NAT table > 3 entries flushed from NAT list > syntax error error at "74111", line 12 > /etc/init.d/ipfboot: load of /etc/opt/ipf/ipnat.conf failed > The error will be attributed to no inbuilt IP Filter proxy module named 74111. > Note that when I load it (without the proxy map) and then run: > > a34-dash-01# ipnat -slv > mapped in 231 out 228 > added 31 expired 0 > no memory 0 bad nat 11 > inuse 1 > rules 6 > wilds 0 > table ffffffff7ffffb28 list 30002a719b0 > List of active MAP/Redirect filters: > rdr bge0 0.0.0.0/0 port 21 -> 198.77.116.127 port 21 tcp > rdr bge0 0.0.0.0/0 port 8575 -> 172.23.66.58 port 8575 tcp > map bge0 0.0.0.0/0 -> 198.77.116.127/32 proxy port ftp ftp/tcp > > It shows up as port 8575! > Calculate 74111 - 65536 = ? > So after a few iterations, I set it to port 112647 at is comes out to > port 47111. Then the redirect works on port 47111, but I still need a > proxy. Strange... > Then you need to review your configurations and enter a value under 65536. If you entered 47111 it would have most probably worked as expected. Can one then deduce the `map' entry was also a typographical error and should read 47111 instead of 74111? Cheer, Larry.
