ipf problems

From: Eric Enright (eric.enright_at_gmail.com)
Date: 04/16/05 

Date: Sat, 16 Apr 2005 14:44:34 -0500

I'm experiencing a weird problem with ipfilter/ipnat. I am forwarding
some ports (specifically Apache is where this cropped up first) with
my router which is a sparc running S10 FCS.

The problem is, the router is randomly refusing the connections.
Only about half of them make it through fine. The router is not under
heavy load, on average handling ~250 connections at a time. Watching
with snoop, I can see that these connection attempts are never
being forwarded to the internal machine at all.

This issue seems to be restricted only to ports I am forwarding.

Here is some relevant configuration:

# ipf.conf
# mxfe0 is the external interface, hme0 the internal

# trust internal devices
pass in quick on lo0 all
pass out quick on lo0 all
pass in quick on hme0 all
pass out quick on hme0 all

# default to blocking everything else
block in all
block out all

# allow new outbound connections
pass out quick on mxfe0 proto tcp from any to any keep state keep frags
pass out quick on mxfe0 proto udp from any to any keep state keep frags
pass out quick on mxfe0 proto icmp from any to any keep state

# redirected ports
pass in quick on mxfe0 proto tcp from any to any port = 80 flags S keep state

# ipnat.conf
map mxfe0 192.168.0.0/24 -> 0/32 proxy port ftp ftp/tcp
map mxfe0 192.168.0.0/24 -> 0/32 portmap tcp/udp auto
map mxfe0 192.168.0.0/24 -> 0/32

rdr mxfe0 0.0.0.0/0 port 80 -> 192.168.0.120 port 80

Any ideas?

Thanks,
Eric

Relevant Pages

  • Re: 2 nics and ips
    ... Matt, thanks for getting back to me. ... That is going through a router which is ... forwarding port 80 to a 192 address. ... We were having both come in through the first nic card and the ports being ...
    (microsoft.public.windows.server.networking)
  • Re: Remote Access - without domain name
    ... We have been trying to set up forwarding the ports for some time now, and have lengthy phone calls and e-mails to Speedtouch support without success. ... This is why I am thinking of buying a modem, is your only criticism of this losing the connection when we restart the server? ... Perhaps you can recommend a different router? ...
    (microsoft.public.windows.server.sbs)
  • Re: Port Scanners
    ... decided to check the NetGear FR314 router I had given them years back. ... He has added Bittorrent forwarding to the router, ... he has also forwarded several ports with the label "recruit" which I don't ...
    (comp.security.firewalls)
  • Re: Can not connect to the Zone server
    ... To accomplish this and the forwarding process for zone.com I ... How do I open ports on my DI804 router for MSN Games: ...
    (microsoft.public.games.zone)
  • Re: 2 pc network - cant see host files from pc 2 on pc 1
    ... Assuming that you have firewall protection via your internet router try ... workgroup because it will be needed for the network to work correctly. ... see if you can access TCP ports 139 and 445 on computer one of which at ... permissions. ...
    (microsoft.public.windowsxp.security_admin)