On Dec 16, 2004, at 8:20 AM, Jason Opperisano wrote:
<...snip...>
have you tried telnet-ing to port 25 from a machine other than localhost? i could be mistaken, but i don't think your rdr rule will apply to a connection from localhost to localhost.
-j
Yes, I always try from a remote host. I was showing from localhost so that you'd know that (a) there is something listening there and (b) that each port has a unique banner, thus I'll know which service I'm getting redirected too. Though that assumes I'm getting redirected in the first place. :)
I'm trying various things as I debug this. Now I've got the MTA listening on *:2525, spamd on *:8025.
# pfctl -F all; pfctl -vv -f /etc/pf.conf
rules cleared
nat cleared
2 tables deleted.
altq cleared
0 states cleared
source tracking entries cleared
pf: statistics cleared
Loaded 345 passive OS fingerprints
table <spamd> persist
table <spamd-white> persist
@0 rdr pass inet proto tcp from 192.168.1.0/24 to 192.168.1.4 port = smtp -> 127.0.0.1 port 8025
@1 block drop in log-all on rl2 all
@2 pass in quick inet proto tcp from any to 192.168.1.4 port = smtp modulate state
@3 pass in quick inet proto tcp from any to 192.168.1.4 port = ssh modulate state
#
# ifconfig rl2
rl2: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
address: 00:e0:29:5b:30:84
media: Ethernet autoselect (100baseTX full-duplex)
status: active
inet 192.168.1.4 netmask 0xffffff00 broadcast 192.168.1.255
inet6 fe80::2e0:29ff:fe5b:3084%rl2 prefixlen 64 scopeid 0x3
# netstat -an|grep LISTEN
tcp 0 0 *.2525 *.* LISTEN
tcp 0 0 127.0.0.1.8026 *.* LISTEN
tcp 0 0 *.8025 *.* LISTEN
tcp 0 0 *.22 *.* LISTEN
tcp 0 0 *.37 *.* LISTEN
tcp 0 0 *.13 *.* LISTEN
tcp 0 0 *.113 *.* LISTEN
tcp6 0 0 *.2525 *.* LISTEN
tcp6 0 0 *.22 *.* LISTEN
tcp6 0 0 *.37 *.* LISTEN
tcp6 0 0 *.13 *.* LISTEN
tcp6 0 0 *.113 *.* LISTEN
#
Now a telnet from another host
[EMAIL PROTECTED] chad/>telnet 192.168.1.4 25 Trying 192.168.1.4... telnet: connect to address 192.168.1.4: Connection refused telnet: Unable to connect to remote host [EMAIL PROTECTED] chad/>
[EMAIL PROTECTED] chad/>telnet 192.168.1.4 2525 Trying 192.168.1.4... Connected to bia.amotken.com. Escape character is '^]'. 220 Chads AVS appliance quit 221 Bye Connection closed by foreign host. [EMAIL PROTECTED] chad/>telnet 192.168.1.4 8025 Trying 192.168.1.4... Connected to bia.amotken.com. Escape character is '^]'. 220 bia.amotken.com ESMTP hello world; Thu Dec 16 14:13:38 2004 quit 221 bia.amotken.com Connection closed by foreign host. [EMAIL PROTECTED] chad/>
Ugh! I can't see why this is not working. I've got inbound rdr working on my production firewall, along with transparent squid proxy on the production firewall. I've done rdr before, but obviously missing something that I just can't see right now.
:(
-Chad
