🚀 go-pugleaf

Sorry - which netmask do you mean :)

Each of the networks and subnet masks are given in CIDR (ie /xx) format.
These translate to the following:

External SHDSL aaa.bbb.ccc.xxx with a netmask of 255.255.255.252 ( allow 2
ip's assigned by my ISP - 1 for the SHDSL router Internal Interface and one
for my Firewal External interface)

Internal LAN 192.168.0.0 with netmask 255.255.255.192 (allow 64 hosts)

DMZ 192.168.10.0 with netmask 255.255.255.252 (allow 2 hosts)

From my knowledge the address allocations are ok - but I may be missing
something :)

Regards
MoRpHinE
----------------------------------------------

"Joan" <someone@microsoft.com> wrote in message
news:amqS8.361013$o66.943633@news-server.bigpond.net.au...
Check your netmask.  Quite often you will see 255.255.255.0 for a 192.168
network, looks like you need 255.255.0.0

--
Joan
http://joan.colley.name:85/
.

"MoRpHinE79" <morphine79@hotmail.SPAM.com> wrote in message
news:pXkS8.360017$o66.942819@news-server.bigpond.net.au...
> Hi all,
>
> I am having some problems with email redirection when using a 3 legged
> configuration on my firewall.  Having read ALL the manuals and then some
:)
> I have racked my brain over this for the last couple of days!!  If anyone
> has any suggestions, I would be most appreciative.
>
> The outline of the setup is shown below:
>
> SHDSL
> External
> ||
> ||
> fxp2
> ------------
> | Firewall   | fxp1 === DMZ (192.168.10.0/30)
> ------------
> fxp0
> ||
> ||
> Internal
> LAN
> (192.168.0.0/26)
>
> Each of the interfaces has a STATIC ip address as shown:
>
> fxp0 192.168.0.1/32
> fxp1 192.168.10.1/32
> fxp2 aaa.bbb.ccc.ddd/32
>
> The Mail Server is directly connected (via x-over) in the DMZ to fxp1.
> The Mail Server has IP: 192.168.10.2/32
> The Firewall has routes between DMZ <-> LAN, LAN <-> External, WORLD <->
DMZ
> The Mail Server has routes between DMZ -> LAN, DMZ -> WORLD
>
> The IPNAT.RULES are provided below
> #####################################
> #
> # Application Proxies
> map fxp2 192.168.0.0/26 -> fxp2/32 proxy port ftp ftp/tcp
> map fxp2 192.168.10.0/30 -> fxp2/32 proxy port ftp ftp/tcp
> # Internal Network NAT Mapping
> map fxp2 192.168.0.0/26 -> fxp2/32 portmap tcp/udp auto
> map fxp2 192.168.0.0/26 -> fxp2/32
> # DMZ Network NAT Mapping
> map fxp2 192.168.10.0/30 -> fxp2/32 portmap tcp/udp auto
> map fxp2 192.168.10.0/30 -> fxp2/32
> # Redirect SMTP
> # use 0/32 to redirect ALL incoming SMTP on FXP2
> rdr fxp2 0/32 port smtp -> 192.168.10.2 port smtp
> rdr fxp0 0/32 port smtp -> 192.168.10.2 port smtp
> EOF
>
> The IPF.RULES is below
> ########################################
> # References:
> # http://www.obfuscation.org/ipf/ipf-howto.html
> # http://www.drones.com/obsd29-fw.html
> # http://www.onlamp.com/pub/a/bsd/2002/02/28/openbsd.html
> ########################################
> # Don't Bother Local Loopback
> pass in quick on lo0 all
> pass out quick on lo0 all
> ########################################
> # Don't Bother the Internal or DMZ
> pass in quick on fxp0
> pass out quick on fxp0
> pass in quick on fxp1
> pass out quick on fxp1
> ########################################
> #
> # Secure the External Interface
> #
> # Block ICMP Redirections and Fragments
> ... <lots of stuff here - see references>
> # Block Private Traffic from Entering
> ... <lots of stuff here - see references>
> # Block Source Routed Packets
> ... <lots of stuff here - see references>
> # Block Private Traffic from Escaping
> ... <lots of stuff here - see references>
> ########################################
> # Filter Incoming & Outgoing Traffic
> # Allow ICMP for Ping & Traceroute
> pass in quick on fxp2 proto icmp from any to any icmp-type echorep
> pass in quick on fxp2 proto icmp from any to any icmp-type echo
> pass in quick on fxp2 proto icmp from any to any icmp-type timex
> pass in quick on fxp2 proto icmp from any to any icmp-type unreach
> block in log quick on fxp2 proto icmp from any to any
> # Allow SSH & SMTP
> #
> pass in quick on fxp2 proto tcp from any to any port = smtp flags S keep
> frags keep state
> pass in quick on fxp2 proto tcp from any to any port = ssh flags S keep
> frags keep state
> # Allow VPN Traffic
> #
> pass in quick on fxp2 proto esp from eee.fff.ggg.hhh/32 to
> aaa.bbb.ccc.ddd/32
> pass in quick on enc0 from 192.168.1.0/29 to 192.168.0.0/26
> pass in quick on enc0 from 192.168.1.0/29 to 192.168.10.0/30
> pass out quick on fxp2 proto esp from aaa.bbb.ccc.ddd/32 to
> eee.fff.ggg.hhh/32
> pass out quick on enc0 from 192.168.0.0/26 to 192.168.1.0/29
> pass out quick on enc0 from 192.168.10.0/30 to 192.168.1.0/29
> # Pass Outgoing Network Traffic
> #
> pass out quick on fxp2 proto tcp from any to any flags S keep frags keep
> state
> pass out quick on fxp2 proto udp from any to any keep state
> pass out quick on fxp2 proto icmp from any to any keep state
> # Block Everything else on External Interface
> #
> block return-rst in log quick on fxp2 proto tcp from any to any
> block return-icmp-as-dest in log quick on fxp2 proto udp from any to any
> block in log quick on fxp2 all
> EOF
>
> Thats it - the mail domain for the mail server has been setup by my ISP,
> with the MX record pointing to the firewall.mydomain.com (reverse PTR also
> configured by ISP).  I can send mail from the firewall to the mail server,
> but I cant seem to send mail from the world to the mail server.  IPnat
> records a connection - IPfilter lets the connection through - but I dont
get
> any email :(
>
> Anyway - any thoughts are most welcome :)
>
> Regards
> MoRpHinE
>
>

On Wed, 26 Jun 2002 23:33:11 GMT, MoRpHinE79 wrote:
>  Sorry - which netmask do you mean :)

[snip]

I'd guess he didn't quite get the part about each network interface should
reside on its own subnet..


- Eirik
-- 
New and exciting signature!