/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */
> -----Original Message-----
> From: George Vieira [mailto:[EMAIL PROTECTED]]
> Sent: Tuesday, May 16, 2000 10:00 PM
> To: '[EMAIL PROTECTED]'
> Subject: [Masq] IPMASQADM PORTFW problem in redhat 6.1
>
> /* HINT: Search archives @ http://www.indyramp.com/masq/
> before posting! */
>
> I'm sorry if this isn't the right list or has been mentioned
> a thousand
> times before but I need help with this redirection function
> under RedHat 6.1
>
> I have enabled IPforwarding and autoforwarding in the kernal
> and have done
> an insmod for ip_forward and ip_masq_portfw.
> I have entered the following in a startup script to enable
> forwarding..
>
> # CLEAR any existing chains
> echo 1 > /proc/sys/net/ipv4/ip_forward
> echo 1 > /proc/sys/net/ipv4/ip_always_defrag
> echo 1 > /proc/sys/net/ipv4/ip_dynaddr
> echo 1 > /proc/sys/net/ipv4/tcp_syncookies
> echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
> echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
>
> /sbin/ipchains -F input
> /sbin/ipchains -F output
> /sbin/ipchains -F forward
>
> /sbin/ipchains -M -S 7200 10 160
>
> # DENY any attempts of SPOOFING
> /sbin/ipchains -A input -j DENY -i eth0 -s 192.168.1.0/24 -d
> 0.0.0.0/0 -l
>
> # FORWARD all local network to anywhere required.
> /sbin/ipchains -A forward -s 192.168.1.0/24 -d 0.0.0.0/0 -j MASQ
>
> /usr/sbin/ipmasqadm portfw -a -P tcp -L 10.10.10.68 43188 -R
> 192.168.1.1
> 43188
>
> My main concern is that I still cannot access the internal machine on
> 192.168.1.1 to port 43188. It doesn't conmect or anything..
>
> My question is "Is there anything majorly important that I
> have missed or
> not mentioned"?
Yep, there always is. :-) How are you testing? Unless you've patched the
kernel, then testing this from INSIDE the masq computer will NOT work. You
MUST test from a machine outside of the MASQ router. The syntax all looks
good there, so I'd suspect that it's probably working, you just can't test
that it is working. :-/ Try again from an outside machine, or even email
me and I can give you a hand testing that if you don't have an external
machine to test from.
Greg
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES
UNSUBSCRIBING!
or email to [EMAIL PROTECTED]
PLEASE read the HOWTO and search the archives before posting.
You can start your search at http://www.indyramp.com/masq/
Please keep general linux/unix/pc/internet questions off the list.
