Hi,
here's a bunch of comments/questions about ip masq.
First, let me say I'm really impressed with how well it's been working
so far.
Let me start with some related information:
In case anybody else is interested, I was able to get Apple's RTSP
proxy to run, which made the quicktime streaming stuff work.
The URL is
http://www.apple.com/quicktime/resources/qt4/us/proxy/proxy.html
This is a user-level proxy daemon for RTSP and RTP.
Note that you have to set the player/plugin up to use the proxy.
(Go in Control Panel->QuickTime->... in Win98 to do that)
The proxy has been relatively stable (crashed once).
The player itself is still in beta (though Apple's web site doesn't
say so.), it froze my machine twice and the IE plugin doesn't work
in IE 5.0. But then again, Win98 freezes once in a while anyway ;-(
The Netscape plugin and the stand-alone version of the player work.
I'd like to ask a few questions about ip masq.
First, my firewall setup (TurboLinux 3.0.1/kernel 2.2.6) is this:
/sbin/ipchains -P forward DENY
/sbin/ipchains -A forward -j MASQ -s 192.168.0.0/255.255.255.0 -d 0.0.0.0/0 -i eth0
/sbin/ipchains -M -S 7200 10 60
Straightforward, an internal LAN connected through a borderrouter.
Everything worked pretty much out of the box (Kudos to the ipmasq and
the turbolinux people!); the only things that still don't work is
active ftp and incoming servers.
I understand that I need an ipmasq ftp module for the port rewriting
stuff in order to use ftp in active mode; is that correct?
Alternatively, I can try to set my clients in passive mode: does anybody
know how to convince netscape to use passive rather than active mode
when doing ftp:// URLs?
In IE, I found an option to use "Web-based FTP": does anybody know
what that means? In any event, it made ftp:// URLs work.
Other clients (Windows/exceed ftp, Linux's ftp and ncftp) I was able
to put in passive mode easily.
Secondly, I was trying to get incoming connections to work.
I tried the ipmasqadm command, but the portfw module didn't seem to
work. I tried to find info on the web, but I got confused.
Can anybody tell me what the authorative faq for Linux masquerading
is? I browsed some one the web and found several documents which mostly
seem to be out-of-date: and if they weren't out-of-date, it wasn't at all
clear to which version of the kernel or the tools they applied.
http://members.home.net/ipmasq/ipmasq-HOWTO-1.65.html
points to http://juanjox.linuxhq.com/
which points at http://juanjox.linuxhq.com/ip_masq-v0.20.README.txt
There, they say to use the "ipmasqadm" command.
However, this does not seem to be supported by my 2.2.6 kernel:
[root@c80384-a rc.d]# ipmasqadm portfw -l
portfw: setsockopt failed: Invalid argument
Could not open "/proc/net/ip_masq/portfw"
Could not open "/proc/net/ip_portfw"
Check if you have enabled portforwarding
Indeed, I don't have these file in /proc/net.
Did I not compile everything into the kernel?
Here's my options:
#
# Networking options
#
CONFIG_PACKET=y
CONFIG_NETLINK=y
CONFIG_RTNETLINK=y
CONFIG_NETLINK_DEV=y
CONFIG_FIREWALL=y
CONFIG_FILTER=y
CONFIG_UNIX=y
CONFIG_INET=y
# CONFIG_IP_MULTICAST is not set
CONFIG_IP_ADVANCED_ROUTER=y
CONFIG_RTNETLINK=y
CONFIG_NETLINK=y
# CONFIG_IP_MULTIPLE_TABLES is not set
# CONFIG_IP_ROUTE_MULTIPATH is not set
# CONFIG_IP_ROUTE_TOS is not set
# CONFIG_IP_ROUTE_VERBOSE is not set
# CONFIG_IP_ROUTE_LARGE_TABLES is not set
# CONFIG_IP_PNP is not set
CONFIG_IP_FIREWALL=y
CONFIG_IP_FIREWALL_NETLINK=y
CONFIG_NETLINK_DEV=y
CONFIG_IP_ALWAYS_DEFRAG=y
CONFIG_IP_TRANSPARENT_PROXY=y
CONFIG_IP_MASQUERADE=y
CONFIG_IP_MASQUERADE_ICMP=y
# CONFIG_IP_ROUTER is not set
CONFIG_NET_IPIP=m
# CONFIG_NET_IPGRE is not set
# CONFIG_IP_ALIAS is not set
# CONFIG_SYN_COOKIES is not set
# CONFIG_INET_RARP is not set
CONFIG_SKB_LARGE=y
# CONFIG_IPX is not set
# CONFIG_ATALK is not set
Or do I need to apply patches to the kernel first?
Specifically, do I need to apply
http://juanjox.linuxhq.com/ip_masq-v0.25-for_2.2.3.patch.gz
Can anybody confirm/deny this?
What confuses me is that some faqs talk about the ipportfw module
while others talk about the portfw module. I assume one is
out-of-date or applies to earlier kernel versions; but I'm not sure.
Sorry for the rambling, I guess my questions are:
+ can I do active ftp with a stock 2.2.6 kernel and if so, how.
+ how do I set up my router to forward incoming connections for say
an sshd or X server.
Thank you,
- Godmar
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
http://tiffany.indyramp.com/mailman/listinfo/masq
Admin requests can be handled by web (above) or [EMAIL PROTECTED]
