Forwarding with IPFilter on Solaris

From: Andreas Höschler (ahoesch_at_smartsoft.de)
Date: 01/30/04

  • Next message: Mario Andrés Yepes C: "Remote backup using ufsdump" 
    Date: Fri, 30 Jan 2004 15:06:16 +0100
To: sunmanagers@sunmanagers.org

    Dear managers,

    We have setup IPFilter as a firewall and NAT to hide a private subnet
    10.0.0.x behind it. This works great. One of the machines in the
    private subnet offers a service on port 1508. We would like to make
    this service available from the outside world. All traffic to port 1508
    sent to the external interface of our Solaris 8 machine should be
    forwarded through the internal interface to the machine in the local
    subnet with ip address 10.0.0.249. We have googled for a while and
    finally added the following lines to the config files (assuming that
    62.150.134.74 is the external ip address of the firewall machine with
    IPFilter installed).

    /etc/opt/ipf/ipnat.conf
    rdr dmfe1 62.150.134.74/32 port 1508 -> 10.0.0.249 port 1508

    /etc/opt/ipf/ipf.conf
    pass in quick on dmfe1 proto tcp from any to any port = 1508 keep state

    We expected this to work after doing

    ipf -Fa -f /etc/opt/ipf/ipf.conf
    ipnat -CF -f /etc/opt/ipf/ipnat.conf

    but it did not. Any idea why? Does anybody has a good example for such
    a setup.

    Thanks a lot!

    Regards,

        Andreas
    _______________________________________________
    sunmanagers mailing list
    sunmanagers@sunmanagers.org
    http://www.sunmanagers.org/mailman/listinfo/sunmanagers

  • Next message: Mario Andrés Yepes C: "Remote backup using ufsdump"

    Relevant Pages

    • Re: Firewall Appliance Recommendation
      ... >> Our current network configuration is a high speed internet connection ... >> the hubs. ... >> We would like to install a firewall between the internet connection ... > from the Public side to a DMZ area within another private subnet. ...
      (comp.security.firewalls)
    • Re: Accessing the printers behind the firewall with a second eth card
      ... > intra-net as well as I already have an IP accessible from outside. ... > a second ethernet card connected to the private subnet, ... then just throw away the firewall and put up a sign that reads ...
      (comp.os.linux.networking)
    • Re: Firewall Implementation Strategy ?
      ... > Currently we are havig a software firewall and the DMZ is in another Private Subnet. ... > We use Port Forwarding from the software firewall to access the DMZ servers from outside. ...
      (Security-Basics)
    • Re: routing question
      ... Matt Smith wrote: ... > I have a situation where I have my FreeBSD box that I want to run 2 ... > Unreal IRCD's on both using port 6667. ... Only if there on your own private subnet, ...
      (freebsd-stable)
    • Re: Firewall Appliance Recommendation
      ... > the hubs. ... > We would like to install a firewall between the internet connection ... from the Public side to a DMZ area within another private subnet. ... Once you have the WatchGuard FireBox in place you can then allow workers ...
      (comp.security.firewalls)