On Thu, 2004-09-16 at 08:58, Steven S. wrote: > Greetings, > > I'm experiencing an interesting problem and I'm googled out. > > Trying to get mail from a firewall which is the carp master to an internally > hosted e-mail server. The mail server is using a private IP address and the > firewall is using a "binat" rule to translate a public carp IP to the > private mail server ip. When the firewall tries to send mail to the mail > server the firewall uses the carp address as the source address. > > Here's some relevant info, > > /etc/pf.conf: > .. > email_pub="1.1.1.180/32" > email_pri="10.0.1.50/32" > .. > binat from $email_pri to any -> $email_pub > .. > Pass this and that... > > [EMAIL PROTECTED] [~]# telnet 1.1.1.180 port 25 > In another window... > [EMAIL PROTECTED] [~]# tcpdump -n -i em3 port 25 > tcpdump: listening on em3 > 21:25:07.753097 1.1.1.180.3944 > 10.0.1.50.25: S 672757334:672757334(0) win > 16384 <mss 1460,nop,nop,sackOK,nop,wscale 0,nop,nop,timestamp 1687436245 0> > (DF) [tos 0x10] > 21:25:07.753349 10.0.1.50.25 > 1.1.1.180.3944: S 634049029:634049029(0) ack > 672757335 win 17520 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 > 0,nop,nop,sackOK> (DF) > 21:25:07.753376 1.1.1.180.3944 > 10.0.1.50.25: R 672757335:672757335(0) win > 0 (DF) > ^C
the above seems to be the result of a blocked packet with "set block-policy return" or a "block return ..." rule ...SYN goes out but SYN-ACK coming back in gets a RST... > My only thought is to try rdr and nat instead of binat, but binat seems > cleaner to me. Any thoughts? my only thought would be to "telnet 10.0.1.50 25"... NAT is for machines outside the firewall that don't know any better. the firewall knows better. -j =~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~ God is a comic playing to an audience that's afraid to laugh. =~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
