>1) We have an internal subnet (10.1.1.x), and our Linux gateway is the only
>machine with an external interface. We have an internal web server, to
>which we're routing all port 80 traffic. It seems to be working great,
>with one exception. Although the internal clients with 10.1.1.x addresses
>can hit any external IP address, thanks to IP masquerading, they cannot hit
>the web server using the external address (which is actually the address of
>the Linux server, which forwards the packets to an internal server).
If I'm reading this correctly, this is a classic example of when you need to
do REDIRECTION vs. port forwarding.
- Port forwarding is used for external servers to get to internal
ones
- Redirection is used for internal servers to get to local external
servers.
Its either this or you have routing issues.
>2) My other question is about pinging, not because we need to do a lot of
>pinging, but because it's sort of a universal test for connectivity. It's
>intriguing that our internal clients cannot ping external hosts with port
>forwarding in the kernel, but they could before we compiled port forwarding
>in. I've gone back and forth between the kernels, and I believe that's the
>difference.
Something is wrong with your setup since I use IPPORTFW on 2.0.36 and
pinging works fine.
>################################################################
>ipfwadm -I -f
>ipfwadm -O -f
>ipfwadm -F -f
>ipfwadm -F -p deny
You should also set your input and output policies to REJECT.
>ipfwadm -F -a masquerade -S 10.1.1.35/24 -D 0.0.0.0/0
You have a HOST address with a Class-C mask in the source field.
Fix this.
>ipfwadm -I -a deny -P all -V 209.195.24.6 -S 10.1.1.0/24 -D 0.0.0.0/0
Don't use -V when possible. Use -W interface-name
>ipportfw -A -t209.195.24.4/80 -R 10.1.1.39/80
>ipportfw -A -t209.195.24.4/443 -R 10.1.1.39/443
>ipportfw -A -t209.195.24.4/21 -R 10.1.1.39/21
>ipportfw -A -u209.195.24.4/525 -R 10.1.1.39/525
The 21 port forward will NOT be reliable unless
you use the new ip_masq_ftp module. Read the
port forwarding section of the new HOWTO for details.
--David
.----------------------------------------------------------------------------.
| David A. Ranch - Linux/Networking/PC hardware [EMAIL PROTECTED] |
!---- ----!
`----- For more detailed info, see http://www.ecst.csuchico.edu/~dranch -----'
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
http://tiffany.indyramp.com/mailman/listinfo/masq
Admin requests can be handled by web (above) or [EMAIL PROTECTED]
