clients can't ping outside
John
I have a filter defined to allow ICMP in/out both public and private NIC's
on the server.
From the server, I can ping outside addresses when I have this filter in
place, can't when I remove this filter.
However, the clients can't ping outside addresses with or without the filter
in place. In fact, if I unload ipflt and filtsrv, the clients still can't
ping outside addresses.
They get a 'destination net unreachable' error. The clients def gw points to
the BM server and the clients are on the same lan segment as the server.
Any ideas what I can try to fix this problem?
TIA
Mysterious
> They get a 'destination net unreachable' error.
no, they get "Reply from xx.xx.xx.xx:destination net unreachable".
the xx.xx.xx.xx is the ip of the device you have to look at it as is the
one sending the error. If it is the pc's ip, your DG is wrong. Check for
typos and verify subnet mask is correct.
Craig Johnson
> In fact, if I unload ipflt and filtsrv, the clients still can't
> ping outside addresses.
>
'end node')
2. Make sure dynamic NAT is enabled on the public IP address (and not
on any other). If it is, try disabling it, reinit, enabling it again,
and another reinit to restart it.
Craig Johnson
Novell Support Connection SysOp
*** For a current patch list, tips, handy files and books on
BorderManager, go to http://www.craigjconsulting.com ***
John
the ip address it shows is the address on my Internet router that sits on
the other side of my BM server.
the BM server has a public IP that is on the same subnet as the Internet
router.
BM is working fine for proxy the way things are but when I ping from a
workstation from a dos prompt, it returns that error.
I'm not sure why a ping fails from the workstation. the def gw on the ws is
set to the bm server private ip.
shouldn't the workstation use the proxy server's public ip address to do the
ping?
i can ping fine from the bm server.
mysterious
> shouldn't the workstation use the proxy server's public ip address to do the
> ping?
> i can ping fine from the bm server.
For that, you have to enable dynamic nat on the public interface on the
bm server.
John
Thank you very much for your help.
John
Thank you very much for your help Craig.
Mysterious
> ok, that's what I didn't have set. It's working now.
> Thank you very much for your help.
>
you're welcome
Craig Johnson
> ok, I didn't have dynamic nat enabled. It's working now.
> Thank you very much for your help Craig.
>
Be sure to test that enabling nat didn't open up other things too much.
For instance, if you can now browse without using a proxy in the
browser, you have filtering issues. (Filters should block non-proxy
browsing).