/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */ My objective: Forward web requests from our linux firewall to an internal web server. Server is Redhat 6.2, 2.2.14-5.0 - stock server install with the addition of the ipmasqadm RPM (ipmasqadm-0.4.2.i386.rpm) from Juan's site - juanjox.kernelnotes.org I was originally using the "Semi-Strong" IPchain script from the Linux IP Masquerade HOWTO section 6.5. When I implemented the portfw, I was unable to connect to the redirected service. However, the IP masquerading entries stated that: "/sbin/ipchains -L -M" IP masquerading entries prot expire source destination ports TCP 00:57.05 10.0.0.18 mail.ultrex.com www (80) -> 63982 "/usr/sbin/ipmasqadm portfw -l" lists: prot localaddr rediraddr lport rport pcnt pref TCP mail2.ultrex.com 10.0.0.18 www www 10 10 So, I anticipated the problem residing with the "reverse" MASQ... I replaced the "Semi-Strong" IPchain script with the following: #/etc/rc.d/rc.firewall /sbin/depmod -a /sbin/modprobe ip_masq_ftp echo "1" > /proc/sys/net/ipv4/ip_forward /sbin/ipchains -M -S 7200 10 160 /sbin/ipchains -P forward DENY /sbin/ipchains -A forward -s 10.0.0.0/24 -j MASQ /sbin/ipchains -I forward -p tcp -s 10.0.0.18/24 80 -j MASQ /usr/sbin/ipmasqadm portfw -a -P tcp -L 209.163.42.155 80 -R 10.0.0.18 80 #End of file The problem continues with the same results - it never connects to the redirected service and times out. Now, I understand that one cannot test the functionality of the portfw from "within" the MASQed network, therefore I have a second linux firewall that is serving as the default gate - I'm testing with that as well as a stand alone computer outside the firewall... same results. During the deep digging throughout the Archive, I have found identical issues, yet no resolutions for them became apparent. If you have any solutions or suggestions, please respond directly to [EMAIL PROTECTED] Thank you for your time. Jake Wegman Technology Concepts [EMAIL PROTECTED] _______________________________________________ Masq maillist - [EMAIL PROTECTED] Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES UNSUBSCRIBING! or email to [EMAIL PROTECTED] PLEASE read the HOWTO and search the archives before posting. You can start your search at http://www.indyramp.com/masq/ Please keep general linux/unix/pc/internet questions off the list.
