🚀 go-pugleaf

Thanks Joerg,

I have created some logs.

Here is what they look like.  I am not sure what they mean.  It looks to me
like its logging the request on the first line but I have some rule
somewhere that blocks the NATed packet.

Apr 11 07:15:47 Gateway kernel: IN=eth1 OUT=
MAC=00:80:c8:4e:1a:33:00:50:ba:d1:a3:82:08:00 SRC=192.168.0.11
DST=192.168.0.1 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=26112 DF PROTO=TCP
SPT=1030 DPT=1723 WINDOW=8192 RES=0x00 SYN URGP=0
Apr 11 07:15:47 Gateway kernel: IN=eth1 OUT=eth1 SRC=192.168.0.11
DST=192.168.0.12 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=26112 DF PROTO=TCP
SPT=1030 DPT=1723 WINDOW=8192 RES=0x00 SYN URGP=0
Apr 11 07:15:49 Gateway kernel: IN=eth1 OUT=
MAC=00:80:c8:4e:1a:33:00:50:ba:d1:a3:82:08:00 SRC=192.168.0.11
DST=192.168.0.1 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=26368 DF PROTO=TCP
SPT=1030 DPT=1723 WINDOW=8192 RES=0x00 SYN URGP=0
Apr 11 07:15:49 Gateway kernel: IN=eth1 OUT=eth1 SRC=192.168.0.11
DST=192.168.0.12 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=26368 DF PROTO=TCP
SPT=1030 DPT=1723 WINDOW=8192 RES=0x00 SYN URGP=0

I have default policies of DROP
$IPTABLES -P INPUT DROP
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT DROP
$IPTABLES -F OUTPUT
$IPTABLES -P FORWARD DROP
$IPTABLES -F FORWARD

I have a rules that let all input and output on the internal interface
$IPTABLES -A INPUT -i $INTIF -j ACCEPT
$IPTABLES -A OUTPUT -o $INTIF -j ACCEPT

I have catchall rules for INPUT and OUTPUT packets for logging
$IPTABLES -A INPUT -s $UNIVERSE -d $UNIVERSE -j drop-and-log-it
$IPTABLES -A OUTPUT -s $UNIVERSE -d $UNIVERSE -j drop-and-log-it

Michael


"Joerg Morbitzer" <jomo@sol-3.de> wrote in message
news:b73k9i$akska$1@ID-162417.news.dfncis.de...
> Michael Hart wrote:
>
> > I am running an NT VPN server on a local subnet behind a RedHat 7.3
> > gateway.
> >
> > I can log onto the NT VPN locally using its local net IP address (i.e.
the
> > VPN seems to be set up correctly) but cannot log on through the gateway
> > (i.e. NAT appears to be not working correctly).
> >
> > I have set up VPN masqurading as per
> > http://www.impsec.org/linux/masquerade/ip_masq_vpn.html
> >
> > i.e.
> >
> > /sbin/iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 1723 -j DNAT
> > --to 192.168.0.40
> > /sbin/iptables -t nat -A PREROUTING -i eth1 -p 47 -j DNAT --to
> > 192.168.0.40
> >
> > I don't know if I have to patch the kernel or recompile it with various
> > options
> >
> > I am using kernel 2.4.19
> >
> > Kernel modules include IP tunnelling.
> >
> > Any help appreciated !!!
> >
> > Michael
>
> It is always good to add more logging to your firewall rules, so before
your
> DNAT setup use the same rule with -j LOG and check the logs. Also, does
the
> NT VPN server has a correct route back to the originating ip address?
>