🚀 go-pugleaf

Are you allowing inbound port 80 in your ipchains rules?  If you enable
logging on your ipchains rules and then run "tail -f /var/log/messages"
you should be able to see where you are being denied.  Again, sounds
like you aren't allowing inbound port 80.

In article <38A7C93C.B6CC7780@c031.aone.net.au>,
  movielink@c031.aone.net.au wrote:
> This is getting to much...
>
> After 17 kernel re-compiles, numerous tests,
> trial and error I can still not get people on
> the Internet onto my internal network:-(((
>
> Here is the system:
> -------------------
>
> A standard RedHat box set up as a firewall between
> an internal network (192.168.x.x) and an Internet
> IP address, using the "PmFirewall" scripts.
>
> Kernel is 2.2.13 with a lot of un-nescesary stuff
> removed (SCSI support, some file systems etc.)
>
> This works great for MASQ to the Internet from my
> internal network.
>
> Trying to get access from the Internet to a WWW server
> running on one of the boxes on the internal network is
> impossible!  Or so it seems.
>
> I have recompiled the kernel more times than I care to
> mention due to overlooking some of the switches to
> enable "portfw" so that "ipmasqadm" could work.
>
> Now all is set up according to the man pages but it
> still will not run.
>
> I have tried to use PING to test it, pointed a www browser
> at it - nothing, no response.
>
> The "/lib/modules/2.2.13/ipv4/ip_masq_portfw.o" file does
> exist and can be loaded - is loaded.
>
> This is the command used:
>
>  /sbin/ipmasqadm portfw -f
>  /sbin/ipmasqadm portfw -a -P tcp -L inet_ip_addr 80 -R 192.168.5.9 80
>
> This should forward the Internet IP, port 80 to the internal machine
on
> 192.168.5.9, port 80.
>
> What am I doing wrong here????
>
> Anthony
>

--
Tim Fischer
MCSE,MCP+Internet
COMPAQ/DEC ASE


Sent via Deja.com http://www.deja.com/
Before you buy.

Anthony White wrote:
> 
> This is getting to much...

Please read on...I have more info to the following.


> 
> After 17 kernel re-compiles, numerous tests,
> trial and error I can still not get people on
> the Internet onto my internal network:-(((
> 
> Here is the system:
> -------------------
> 
> A standard RedHat box set up as a firewall between
> an internal network (192.168.x.x) and an Internet
> IP address, using the "PmFirewall" scripts.

[...most snipped...]

> The "/lib/modules/2.2.13/ipv4/ip_masq_portfw.o" file does
> exist and can be loaded - is loaded.
> 
> This is the command used:
> 
>  /sbin/ipmasqadm portfw -f
>  /sbin/ipmasqadm portfw -a -P tcp -L inet_ip_addr 80 -R 192.168.5.9 80

When changing the above to 

   /sbin/ipmasqadm portfw -a -P tcp -L inet_ip_addr 4000 -R 192.168.5.9
80

 and then point my browser to "inet_ip_addr" all works!!!

In other words when using port 4000 to request www pages the thing gets
forwarded just fine.  This means that there must be a problem with
blocking
port 80 in my IpChains rules - but where???

> 
> This should forward the Internet IP, port 80 to the internal machine on
> 192.168.5.9, port 80.

It does not, see above...

Without seeing your entire firewall script I guess I can't tell you
where it's being blocked.  Either post the whole script or enable
logging and post that or both.

In article <38A7DD65.DB0D2A49@c031.aone.net.au>,
  movielink@c031.aone.net.au wrote:
> Anthony White wrote:
> >
> > This is getting to much...
>
> Please read on...I have more info to the following.
>
> >
> > After 17 kernel re-compiles, numerous tests,
> > trial and error I can still not get people on
> > the Internet onto my internal network:-(((
> >
> > Here is the system:
> > -------------------
> >
> > A standard RedHat box set up as a firewall between
> > an internal network (192.168.x.x) and an Internet
> > IP address, using the "PmFirewall" scripts.
>
> [...most snipped...]
>
> > The "/lib/modules/2.2.13/ipv4/ip_masq_portfw.o" file does
> > exist and can be loaded - is loaded.
> >
> > This is the command used:
> >
> >  /sbin/ipmasqadm portfw -f
> >  /sbin/ipmasqadm portfw -a -P tcp -L inet_ip_addr 80 -R 192.168.5.9
80
>
> When changing the above to
>
>    /sbin/ipmasqadm portfw -a -P tcp -L inet_ip_addr 4000 -R
192.168.5.9
> 80
>
>  and then point my browser to "inet_ip_addr" all works!!!
>
> In other words when using port 4000 to request www pages the thing
gets
> forwarded just fine.  This means that there must be a problem with
> blocking
> port 80 in my IpChains rules - but where???
>
> >
> > This should forward the Internet IP, port 80 to the internal
machine on
> > 192.168.5.9, port 80.
>
> It does not, see above...
>

--
Tim Fischer
MCSE,MCP+Internet
COMPAQ/DEC ASE


Sent via Deja.com http://www.deja.com/
Before you buy.

Anthony White wrote:
> 
> Anthony White wrote:
> >
> > This is getting to much...
> 
> Please read on...I have more info to the following.
> 

Final information....

I have now got things to work and think
that some one out there may have had the
same issues as I.

The prolem getting it to work was the lack
of a IPChains rule to allow access on port 80.

When I installed Pmfirewall one of the options
was to say yes to a www server.  I said NO as the
firewall was not going to run as a server for
anything.  It is strictly a gateway.

Reading and cross referencing between various
documentation it turns out that if you want to run
a www server on an internal machine behind the
firewall machine then the rule must be set to ACCEPT
port 80 requests on the input chain.  If not set
the requests don't even reach the port forwarding
code before being 'killed'.

With port forwarding ON the request gets through
and is then forwarded to the internal network
as specified.

That is a clasic 'got-ya' situation.  Had I set
Pmfirewall up to allow the gateway to be a www
server, all would have been fine.

Well, it is a learning experience to work with
linux...:-)

Now I can attack getting mail up and running.


Anthony