Sorry for such a late reply to this list......
[EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote:
>
> I wouldn't ordinarily consider port fowarding to be a good topic for
> this list...
Why not? It ties directly in with masq. :)
> 1) [... classic web-redirection problem ... ]
This is a problem because the kernel doesn't recognize traffic that
comes in one interface, and goes back out the same interface, to be
correctly-forwarded traffic. That's essentially what you're asking the
kernel to do by asking it to port-forward internal LAN addresses through
the masq firewall.
The solution to this problem is either simple, or difficult, depending
on the scope of it.
The easiest thing to do is put a 'HOSTS' file on every Windows client,
containing the internal IP address of your web server, with the
fully-qualified external name. This way, when the Windows box tries to
look up your web server's address, it will find the internal server, and
connect directly to it, without using the firewall box at all. That's
as it should be. Any other lookup will occur via DNS, so there won't be
any loss of functionality. Just a lot of trouble if you decide to move
the server. :)
If you have a lot (hundreds) of Windows boxes, this might be more of a
difficult solution. In which case, the only thing I can offer is to
have two different name servers, serving different IP addresses to
internal vs. external clients....
Another solution is the one that D. Ranch suggested, to use a
tcp-redirector, which will work no matter which direction the traffic is
coming from. However, it has its own problems, so I don't recommend it
unless you're desperate.
> 2) It's intriguing that our internal clients cannot ping external
> hosts with port forwarding in the kernel, but they could before we
> compiled port forwarding in.
It's possible that the MASQ_ICMP option was inadvertently removed when
you built the kernel with port-forwarding. It's all I can think of.
Check your kernel-config closely.
--
[EMAIL PROTECTED] (Fuzzy Fox) || "Nothing takes the taste out of peanut
sometimes known as David DeSimone || butter quite like unrequited love."
http://www.dallas.net/~fox/ || -- Charlie Brown
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
http://tiffany.indyramp.com/mailman/listinfo/masq
Admin requests can be handled by web (above) or [EMAIL PROTECTED]
