Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

NAT Under OSR505, port forwarding not working.

0 views
Skip to first unread message

Wayne Jackson

unread,
Jul 31, 2000, 3:00:00 AM7/31/00
to
I have been tinkering with the my OSR505 machine over the weekend, and
successfully got it to connect to the cable service at BigPond.

Every aspect works such as http and ftp, but if I need to connect to a ftp
server directly instead of through the proxy server, I get "Cannot open port
on 192.168.200.100". I have done this with Linux, and it works fine, I can
get directories and files, with IP Masquerading.

Is there anyone working on the IP NAT under OSR505 to include port
forwarding?

Better yet, does UW7 support full NAT and IP forwarding?

Wayne


Ian Peattie

unread,
Aug 1, 2000, 3:00:00 AM8/1/00
to
In article <JVnh5.17501$4p3.1...@news-server.bigpond.net.au>, "Wayne Jackson" <warp...@bigpond.net.au.MAPSON> wrote:

>Every aspect works such as http and ftp, but if I need to connect to a ftp
>server directly instead of through the proxy server, I get "Cannot open port
>on 192.168.200.100". I have done this with Linux, and it works fine, I can
>get directories and files, with IP Masquerading.

FTP via NAT works fine here under 5.0.5. Show us your NAT rules. You'll need
something like this:

map du0 192.168.200.0/24 -> [ip of your 5.0.5 box]/32 proxy port ftp ftp/tcp

Another possible problem with ftp via NAT is that your firewall may not be
allowing the return connection from the ftp site.

Ian.

--
Ian Peattie i...@john-richard.co.uk
Edinburgh, Scotland.

Wayne Jackson

unread,
Aug 1, 2000, 3:00:00 AM8/1/00
to
I am using the somewhat the same settings as those on
http://www.aplawrence.com/Security/ipfilter.shtml expect that it is set to
my IP address range and such.

I can ftp from the OSR machine, just not from anyother machine behind it.

> map du0 192.168.200.0/24 -> [ip of your 5.0.5 box]/32 proxy port ftp
ftp/tcp

Is that your setup? With the proxy etc details after it?

Wayne

Ian Peattie

unread,
Aug 1, 2000, 3:00:00 AM8/1/00
to

Apart from the basic NAT rule, that's it. In /etc/rc2.d/S99Nat I have this.

/etc/ipnat -f - <<EOF

map du0 192.168.0.0/24 -> 158.152.99.138/32 proxy port ftp ftp/tcp
map du0 192.168.0.0/24 -> 158.152.99.138/32

EOF

I do run proxies for other traffic, such as http, but that's more for the
benifit of caching. NAT would allow direct connections.

Now, again, let's see YOUR setup. What output do you get from 'ipnat -l'. It's
very difficult see what your problem is if you don't give this information.

Wayne Jackson

unread,
Aug 1, 2000, 3:00:00 AM8/1/00
to
/ # ipnat -l
List of active MAP/Redirect filters:
map net0 192.168.200.0/24 -> 24.192.93.65/32

List of active sessions:
MAP 192.168.200.100 4199 <- -> 24.192.93.65 4199 [203.32.8.37 110]
MAP 192.168.200.100 3687 <- -> 24.192.93.65 3687 [203.2.192.76 110]
MAP 192.168.200.100 2507 <- -> 24.192.93.65 2507 [24.192.1.30 110]
/ #
--------------------------------
#!/bin/ksh
MYIP=`ifconfig net0 | grep inet | awk '{ print $2 }'`
ipnat -F
ipnat -C
ipnat -f - <<EOF
map net0 192.168.200.0/24 -> $MYIP/32
EOF

That is what my setup is.

Wayne

"Ian Peattie" <i...@john-richard.co.uk> wrote in message
news:8m66pe$ih5$1...@odin.john-richard.co.uk...

Ian Peattie

unread,
Aug 1, 2000, 3:00:00 AM8/1/00
to
In article <S3yh5.18132$4p3.1...@news-server.bigpond.net.au>, "Wayne Jackson" <warp...@bigpond.net.au.MAPSON> wrote:
>/ # ipnat -l
>List of active MAP/Redirect filters:
>map net0 192.168.200.0/24 -> 24.192.93.65/32

OK, you have NAT in place, but no proxy for ftp. Because ftp is such a funny
protocol, you need a special proxy to handle it. Luckily, the 5.0.5 NAT has
such a proxy built into it.


>#!/bin/ksh
>MYIP=`ifconfig net0 | grep inet | awk '{ print $2 }'`
>ipnat -F
>ipnat -C
>ipnat -f - <<EOF
>map net0 192.168.200.0/24 -> $MYIP/32
>EOF

To add the ftp proxy, change your script to this:

----(start)---


#!/bin/ksh
MYIP=`ifconfig net0 | grep inet | awk '{ print $2 }'`
ipnat -F
ipnat -C
ipnat -f - <<EOF

map net0 192.168.200.0/24 -> $MYIP/32 proxy port ftp ftp/tcp


map net0 192.168.200.0/24 -> $MYIP/32
EOF

----(end)----

and then re-run it.

Wayne Jackson

unread,
Aug 1, 2000, 3:00:00 AM8/1/00
to
Where can I get further info on ipnat? man ipnat returns nothing,
ipnat --help only returns the options.

I will try the settings that you gave me later today/tonight as I am away
for most/all of the day.

Wayne


"Ian Peattie" <i...@john-richard.co.uk> wrote in message

news:8m6c9q$md7$1...@odin.john-richard.co.uk...

Jean-Pierre Radley

unread,
Aug 1, 2000, 3:00:00 AM8/1/00
to ScoMisc [c.u.s.m]
Wayne Jackson propounded (on Tue, Aug 01, 2000 at 09:14:51PM +0000):

| Where can I get further info on ipnat? man ipnat returns nothing,
| ipnat --help only returns the options.
|

Start at http://coombs.anu.edu.au/~avalon/ip-filter.html

--
JP

slowtolearn

unread,
Aug 1, 2000, 3:00:00 AM8/1/00
to
Another place to look, pretty easy to read/follow:

http://www.aplawrence.com/Security/ipfilter.html

Hope this helps

On Mon, 31 Jul 2000 23:25:29 GMT, "Wayne Jackson"
<warp...@bigpond.net.au.MAPSON> wrote:

>I have been tinkering with the my OSR505 machine over the weekend, and
>successfully got it to connect to the cable service at BigPond.
>

>Every aspect works such as http and ftp, but if I need to connect to a ftp
>server directly instead of through the proxy server, I get "Cannot open port
>on 192.168.200.100". I have done this with Linux, and it works fine, I can
>get directories and files, with IP Masquerading.
>

0 new messages