NAT Under OSR505, port forwarding not working.
Wayne Jackson
successfully got it to connect to the cable service at BigPond.
Every aspect works such as http and ftp, but if I need to connect to a ftp
server directly instead of through the proxy server, I get "Cannot open port
on 192.168.200.100". I have done this with Linux, and it works fine, I can
get directories and files, with IP Masquerading.
Is there anyone working on the IP NAT under OSR505 to include port
forwarding?
Better yet, does UW7 support full NAT and IP forwarding?
Wayne
Ian Peattie
>Every aspect works such as http and ftp, but if I need to connect to a ftp
>server directly instead of through the proxy server, I get "Cannot open port
>on 192.168.200.100". I have done this with Linux, and it works fine, I can
>get directories and files, with IP Masquerading.
FTP via NAT works fine here under 5.0.5. Show us your NAT rules. You'll need
something like this:
map du0 192.168.200.0/24 -> [ip of your 5.0.5 box]/32 proxy port ftp ftp/tcp
Another possible problem with ftp via NAT is that your firewall may not be
allowing the return connection from the ftp site.
Ian.
--
Ian Peattie i...@john-richard.co.uk
Edinburgh, Scotland.
Wayne Jackson
http://www.aplawrence.com/Security/ipfilter.shtml expect that it is set to
my IP address range and such.
I can ftp from the OSR machine, just not from anyother machine behind it.
> map du0 192.168.200.0/24 -> [ip of your 5.0.5 box]/32 proxy port ftp
ftp/tcp
Is that your setup? With the proxy etc details after it?
Wayne
Ian Peattie
Apart from the basic NAT rule, that's it. In /etc/rc2.d/S99Nat I have this.
/etc/ipnat -f - <<EOF
map du0 192.168.0.0/24 -> 158.152.99.138/32 proxy port ftp ftp/tcp
map du0 192.168.0.0/24 -> 158.152.99.138/32
EOF
I do run proxies for other traffic, such as http, but that's more for the
benifit of caching. NAT would allow direct connections.
Now, again, let's see YOUR setup. What output do you get from 'ipnat -l'. It's
very difficult see what your problem is if you don't give this information.
Wayne Jackson
List of active MAP/Redirect filters:
map net0 192.168.200.0/24 -> 24.192.93.65/32
List of active sessions:
MAP 192.168.200.100 4199 <- -> 24.192.93.65 4199 [203.32.8.37 110]
MAP 192.168.200.100 3687 <- -> 24.192.93.65 3687 [203.2.192.76 110]
MAP 192.168.200.100 2507 <- -> 24.192.93.65 2507 [24.192.1.30 110]
/ #
--------------------------------
#!/bin/ksh
MYIP=`ifconfig net0 | grep inet | awk '{ print $2 }'`
ipnat -F
ipnat -C
ipnat -f - <<EOF
map net0 192.168.200.0/24 -> $MYIP/32
EOF
That is what my setup is.
Wayne
"Ian Peattie" <i...@john-richard.co.uk> wrote in message
news:8m66pe$ih5$1...@odin.john-richard.co.uk...
Ian Peattie
>/ # ipnat -l
>List of active MAP/Redirect filters:
>map net0 192.168.200.0/24 -> 24.192.93.65/32
OK, you have NAT in place, but no proxy for ftp. Because ftp is such a funny
protocol, you need a special proxy to handle it. Luckily, the 5.0.5 NAT has
such a proxy built into it.
>#!/bin/ksh
>MYIP=`ifconfig net0 | grep inet | awk '{ print $2 }'`
>ipnat -F
>ipnat -C
>ipnat -f - <<EOF
>map net0 192.168.200.0/24 -> $MYIP/32
>EOF
To add the ftp proxy, change your script to this:
----(start)---
#!/bin/ksh
MYIP=`ifconfig net0 | grep inet | awk '{ print $2 }'`
ipnat -F
ipnat -C
ipnat -f - <<EOF
map net0 192.168.200.0/24 -> $MYIP/32 proxy port ftp ftp/tcp
map net0 192.168.200.0/24 -> $MYIP/32
EOF
----(end)----
and then re-run it.
Wayne Jackson
ipnat --help only returns the options.
I will try the settings that you gave me later today/tonight as I am away
for most/all of the day.
Wayne
"Ian Peattie" <i...@john-richard.co.uk> wrote in message
news:8m6c9q$md7$1...@odin.john-richard.co.uk...
Jean-Pierre Radley
| Where can I get further info on ipnat? man ipnat returns nothing,
| ipnat --help only returns the options.
|
Start at http://coombs.anu.edu.au/~avalon/ip-filter.html
--
JP
slowtolearn
http://www.aplawrence.com/Security/ipfilter.html
Hope this helps
On Mon, 31 Jul 2000 23:25:29 GMT, "Wayne Jackson"
<warp...@bigpond.net.au.MAPSON> wrote:
>I have been tinkering with the my OSR505 machine over the weekend, and
>successfully got it to connect to the cable service at BigPond.
>
>Every aspect works such as http and ftp, but if I need to connect to a ftp
>server directly instead of through the proxy server, I get "Cannot open port
>on 192.168.200.100". I have done this with Linux, and it works fine, I can
>get directories and files, with IP Masquerading.
>