RE: IPNAT / IPF / rdr issue

From: fbsd_user (fbsd_user_at_a1poweruser.com)
Date: 06/26/05

  • Next message: Bill Schoolcraft: "psm0: [GIANT-LOCKED]" 
    To: "Andy Sutcliffe" <andy.sutcliffe@gmail.com>
Date: Sat, 25 Jun 2005 23:03:49 -0400

    Do you have your mydomain.com in the /etc/hosts file on the gateway?
    All your clients are on the LAN behind the gateway correct.
    Do you have static IP from your ISP?
    Are you using a dynamic DNS service?
    Explain you cabling layout of your network.

    -----Original Message-----
    From: Andy Sutcliffe [mailto:andy.sutcliffe@gmail.com]
    Sent: Saturday, June 25, 2005 10:36 PM
    To: fbsd_user@a1poweruser.com
    Cc: freebsd-questions@freebsd.org
    Subject: Re: IPNAT / IPF / rdr issue

    I tried that as well, but am still getting the same 'connection
    refused' error from the web browser on the local client machine.

    On 6/25/05, fbsd_user <fbsd_user@a1poweruser.com> wrote:
    > Your using the public ip address of your gateway box from the
    > private LAN.
    > In this mode NAT and thus your rdr rule is never evoked. Your
    > request never exits your private network. The gateway system knows
    > himself by that public ip address.
    > What you should be doing is using the www.domainname.com so the
    > request has to go to your ISP DNS server to get your public ip
    > address, then it will enter on the external interface and be
    > nated/rdr to correct location.
    > There is nothing wrong with your ipfilter configuration, your just
    > using the wrong URL.
    >
    > -----Original Message-----
    > From: owner-freebsd-questions@freebsd.org
    > [mailto:owner-freebsd-questions@freebsd.org]On Behalf Of Andy
    > Sutcliffe
    > Sent: Saturday, June 25, 2005 9:01 PM
    > To: freebsd-questions@freebsd.org
    > Subject: IPNAT / IPF / rdr issue
    >
    >
    > I am having problems accessing internal resources (such as a web
    > server) from other internal clients when going from internal
    > client ->
    > public address -> internal resource. For example, when I attempt
    to
    > reach 'mydomain.com' from client machine X, the connection is
    > refused
    > (I am of course, able to reach the web server through the internal
    > IP), however, I am able to access the web server via that URL from
    > an
    > external network. I have 'mydomain.com' pointed towards the
    > external
    > IP of my gateway which in turn relays it to the internal web
    server.
    > I have included the pertinent contents of /etc/ipnat.rules as well
    > as
    > my /etc/ipf.conf file. I am at a loss at this point...can anyone
    > point me in the right direction ?
    >
    > Thanks in advance,
    > - andy ( andy dot sutcliffe at gmail dot com)
    >
    > Gateway:
    > OS:FreeBSD 5.4
    > Firewall: IPFilter
    > Port Forwarding: IPNAT
    > External eth: dc0
    > Internal eth: ed0 (10.0.0.0)
    >
    > Web Server
    > OS: FreeBSD 5.4
    > WWW: Apache 2.0
    >
    > Client Machine(s)
    > OS: Windows XP, FreeBSD, Linux
    >
    > I have the following in /etc/ipnat.rules:
    >
    > # innernet
    > map dc0 10.0.0.0/16 -> 0.0.0.0/32 portmap tcp/udp 40000:65000
    > map dc0 10.0.0.0/16 -> 0.0.0.0/32
    >
    > # www
    > rdr dc0 0.0.0.0/0 port 80 -> 10.0.0.3 port 80
    >
    > I have the following in /etc/ipf.conf:
    > #################################################################
    > # No restrictions on Inside LAN Interface for private network
    > # Not needed unless you have LAN
    > #################################################################
    >
    > pass out quick on ed0 all
    > pass in quick on ed0 all
    >
    > #################################################################
    > # No restrictions on Loopback Interface
    > #################################################################
    > pass in quick on lo0 all
    > pass out quick on lo0 all
    >
    > #################################################################
    > # Interface facing Public Internet (Outbound Section)
    > # Interrogate session start requests originating from behind the
    > # firewall on the private network
    > # or from this gateway server destine for the public Internet.
    > #################################################################
    >
    > # Allow out access to my ISP's Domain name server.
    > # xxx must be the IP address of your ISP's DNS.
    > # Dup these lines if your ISP has more than one DNS server
    > # Get the IP addresses from /etc/resolv.conf file
    > pass out quick on dc0 proto tcp from any to 67.43.192.6 port = 53
    > flags S keep state
    > pass out quick on dc0 proto udp from any to 67.43.192.6 port = 53
    > keep state
    > pass out quick on dc0 proto tcp from any to 137.118.1.33 port = 53
    > flags S keep state
    > pass out quick on dc0 proto udp from any to 137.118.1.33 port = 53
    > keep state
    >
    > # Allow out access to my ISP's DHCP server for cable or DSL
    > networks.
    > # This rule is not needed for 'user ppp' type connection to the
    > # public Internet, so you can delete this whole group.
    > # Use the following rule and check log for IP address.
    > # Then put IP address in commented out rule & delete first rule
    > pass out quick on dc0 proto udp from any to 67.43.192.6 port = 67
    > keep state
    >
    >
    > # Allow out non-secure standard www function
    > pass out quick on dc0 proto tcp from any to any port = 80 flags S
    > keep state
    > pass out quick on dc0 proto tcp from any to any port = 81 flags S
    > keep state
    >
    > # Allow out secure www function https over TLS SSL
    > pass out quick on dc0 proto tcp from any to any port = 443 flags S
    > keep state
    >
    > # Allow out send & get email function
    > pass out quick on dc0 proto tcp from any to any port = 110 flags S
    > keep state
    > pass out quick on dc0 proto tcp from any to any port = 25 flags S
    > keep state
    >
    > # Allow out Time
    > pass out quick on dc0 proto tcp from any to any port = 37 flags S
    > keep state
    >
    > # Allow out nntp news
    > pass out quick on dc0 proto tcp from any to any port = 119 flags S
    > keep state
    >
    > # Allow out gateway & LAN users non-secure FTP ( both passive &
    > active modes)
    > # This function uses the IPNAT built in FTP proxy function coded
    in
    > # the nat rules file to make this single rule function correctly.
    > # If you want to use the pkg_add command to install application
    > packages
    > # on your gateway system you need this rule.
    > pass out quick on dc0 proto tcp from any to any port = 21 flags S
    > keep state
    >
    > # Allow out secure FTP, Telnet, and SCP
    > # This function is using SSH (secure shell)
    > pass out quick on dc0 proto tcp from any to any port = 22 flags S
    > keep state
    >
    > # Allow out non-secure Telnet
    > pass out quick on dc0 proto tcp from any to any port = 23 flags S
    > keep state
    >
    > # Allow out FBSD CVSUP function
    > pass out quick on dc0 proto tcp from any to any port = 5999 flags
    S
    > keep state
    >
    > # Allow out ping to public Internet
    > pass out quick on dc0 proto icmp from any to any icmp-type 8 keep
    > state
    >
    > # Allow out whois for LAN PC to public Internet
    > pass out quick on dc0 proto tcp from any to any port = 43 flags S
    > keep state
    >
    > # Block and log only the first occurrence of everything
    > # else that's trying to get out.
    > # This rule enforces the block all by default logic.
    > block out log first quick on dc0 all
    >
    > #################################################################
    > # Interface facing Public Internet (Inbound Section)
    > # Interrogate packets originating from the public Internet
    > # destine for this gateway server or the private network.
    > #################################################################
    >
    > # Block all inbound traffic from non-routable or reserved address
    > spaces
    > block in quick on dc0 from 192.168.0.0/16 to any #RFC 1918
    > private IP
    > block in quick on dc0 from 172.16.0.0/12 to any #RFC 1918
    > private IP
    > # block in quick on dc0 from 10.0.0.0/8 to any #RFC 1918
    > private IP
    > block in quick on dc0 from 127.0.0.0/8 to any #loopback
    > block in quick on dc0 from 0.0.0.0/8 to any #loopback
    > block in quick on dc0 from 169.254.0.0/16 to any #DHCP
    > auto-config
    > block in quick on dc0 from 192.0.2.0/24 to any #reserved for
    > docs
    > block in quick on dc0 from 204.152.64.0/23 to any #Sun cluster
    > interconnect
    > block in quick on dc0 from 224.0.0.0/3 to any #Class D & E
    > multicast
    >
    > ##### Block a bunch of different nasty things. ############
    > # That I do not want to see in the log
    >
    > # Block frags
    > block in quick on dc0 all with frags
    >
    > # Block short tcp packets
    > block in quick on dc0 proto tcp all with short
    >
    > # block source routed packets
    > block in quick on dc0 all with opt lsrr
    > block in quick on dc0 all with opt ssrr
    >
    > # Block nmap OS fingerprint attempts
    > # Log first occurrence of these so I can get their IP address
    > block in log first quick on dc0 proto tcp from any to any flags
    FUP
    >
    > # Block anything with special options
    > block in quick on dc0 all with ipopts
    >
    > # Block public pings
    > block in quick on dc0 proto icmp all icmp-type 8
    >
    > # Block ident
    > block in quick on dc0 proto tcp from any to any port = 113
    >
    > # Block all Netbios service. 137=name, 138=datagram, 139=session
    > # Netbios is MS/Windows sharing services.
    > # Block MS/Windows hosts2 name server requests 81
    > block in log first quick on dc0 proto tcp/udp from any to any port
    =
    > 137
    > block in log first quick on dc0 proto tcp/udp from any to any port
    =
    > 138
    > block in log first quick on dc0 proto tcp/udp from any to any port
    =
    > 139
    > block in log first quick on dc0 proto tcp/udp from any to any port
    =
    > 81
    >
    > # Allow traffic in from ISP's DHCP server. This rule must contain
    > # the IP address of your ISP's DHCP server as it's the only
    > # authorized source to send this packet type. Only necessary for
    > # cable or DSL configurations. This rule is not needed for
    > # 'user ppp' type connection to the public Internet.
    > # This is the same IP address you captured and
    > # used in the outbound section.
    > pass in quick on dc0 proto udp from 67.43.192.6 to any port = 68
    > keep state
    >
    > # Allow in standard www function because I have apache server
    > pass in quick on dc0 proto tcp from any to any port = 80 flags S
    > keep state
    > pass in quick on dc0 proto tcp from any to any port = 81 flags S
    > keep state
    >
    > # Allow in secure FTP, Telnet, and SCP from public Internet
    > # This function is using SSH (secure shell)
    > pass in quick on dc0 proto tcp from any to any port = 22 flags S
    > keep state
    >
    > # Allow in non-scure FTP access to file server (bombadil)
    > pass in quick on dc0 proto ftp from any to 10.0.0.2 port = 21
    flags
    > S keep state
    > pass in quick on dc0 proto ftp from any to 10.0.0.2 port = 20
    flags
    > S keep state
    > pass out quick on dc0 proto ftp from 10.0.0.2 to any port = 20
    flags
    > S
    > keep state
    >
    > # Block and log only first occurrence of all remaining traffic
    > # coming into the firewall. The logging of only the first
    > # occurrence stops a .denial of service. attack targeted
    > # at filling up your log file space.
    > # This rule enforces the block all by default logic.
    > block in log first quick on dc0 all
    > ################### End of rules file
    > #####################################
    > _______________________________________________
    > freebsd-questions@freebsd.org mailing list
    > http://lists.freebsd.org/mailman/listinfo/freebsd-questions
    > To unsubscribe, send any mail to
    > "freebsd-questions-unsubscribe@freebsd.org"
    >
    >

    _______________________________________________
    freebsd-questions@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-questions
    To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"

  • Next message: Bill Schoolcraft: "psm0: [GIANT-LOCKED]"

    Relevant Pages

    • Re: Default Gateway on VPN subnets
      ... Now I understand that you are using the TZ170 VPN routers to establish the ... Once the default gateway of the remote 2003 server was automatically ... to access the internet or the SBS network? ...
      (microsoft.public.windows.server.sbs)
    • RE: ISA 2004 Firewall Client and ActiveSync 4.2
      ... at home in my WLAN all internet ... that killing my default gateway is not the way ... gateway and the appropriate DNS server entries. ... server internal IP then your client works as a secureNAT client and you're ...
      (microsoft.public.isa.clients)
    • Re: Half Bridge mode and multi-homed box
      ... The router takes all the authentication and link negotiation burden ... > laptop screen whilst I tried to replicate it on the server. ... helldesk of provider) from whoever remembers it for too long. ... The provider's gateway is on a completely different ...
      (comp.unix.bsd.freebsd.misc)
    • Re: Half Bridge mode and multi-homed box
      ... The router takes all the authentication and link negotiation burden ... > that the server somehow doesn't ask for a default gateway. ... I tried putting the default route that the laptop gets into rc.conf. ...
      (comp.unix.bsd.freebsd.misc)