/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */
Hajime Lucky Okada wrote:
> Still there is a little problem about ftp, so I will try to use the tool
> "fwhelper" you introduced me for it.
you probably need to load the ip_masq_ftp module.
check that out first.
> > also, it looks like the firewall/masquerading host will masquerade
> > any packets that it receives via eth1 that need to be forwarded via
> > eth2 or vice versa. this is probably a mistake. do something like
> > the following to prevent this:
> >
> > # Accept (unmasqueraded) traffic amongst multiple internal networks
> >
> > for src in $INTERNAL_NETWORKS
> > do
> > for dst in $INTERNAL_NETWORKS
> > do
> > if [ "$src" != "$dst" ]
> > then
> > ipchains -A forward -s $src -d $dst -j ACCEPT
> > fi
> > done
> > done
> >
> > # Masquerade traffic from internal networks to the outside world
> >
> > for masqnet in $INTERNAL_NETWORKS
> > do
> > ipchains -A forward -s $masqnet -j MASQ
> > done
>
> About this, I have to add explanation.
>
> To say exactly, I settle a data base host protected by firewall on the
> another network "eth1", that functions passively.
>
> On HOST-F/W, I have HOST-1 to be able to access to both of HOST-WWW
> thru eth0 and data base host thru eth1.
> The HOST-WWW and data base host only reply for this access from HOST-1,
> principally. When this access from HOST-1, the ip address would be
> masquerade to eth0 (to HOST-WWW) or to eth1 (to data base host).
>
> In this moment, the data base host will not access to another host
> by itself.
>
> In very near future, the HOST-WWW should access to the data base host
> to serve it's data on Web. For this, I will allow it by applying
> rules of port forwarding 'ipmasqadm' on HOST-F/W from eth0 to eth1,
> because the access should be very limited.
>
> So, I think it would not be so necessary for applying above scripts
> for this schematic, what dp you think?
hard to say from here. i'd suggest not worrying about it unless
it turns out to be a problem. it's just that all packets travelling
via HOST-F/W via eth1 to the database host will be masqueraded to
look like they came from HOST-F/W even when they originated on HOST-1.
of course, this might not be a problem at all. just wait and see :)
> Anyhow, thanks again !
> Jaime.
no worries :)
> PS: Is there no way to receive these message in each...
> (not digest version) ???
yes, there is. go to http://www.indyramp.com/mailman/listinfo/masq
from there you can enter your mail address at the bottom and click
"Edit Options" which takes you a page where you can turn off digest
mode.
raf
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES
UNSUBSCRIBING!
or email to [EMAIL PROTECTED]
PLEASE read the HOWTO and search the archives before posting.
You can start your search at http://www.indyramp.com/masq/
Please keep general linux/unix/pc/internet questions off the list.
