🚀 go-pugleaf

On 26 Dec 2000 13:55:54 GMT, huge@nospam.huge.org.uk (Huge) wrote:

>Has anyone tried to connect a small network to demon through a Solaris
>NAT gateway?

Yes :-) , although I ran postfix on the NAT host so didn't hit this
problem.

>So, I am trying to do the second. If I understand the ipfilter
>manual correctly, I should be able to do this;
>
>map ipdptp0 10.0.0.0/24 -> 158.152.24.143/32

That doesn't rewrite source ports and there may be clashes.  I'd
prefer:

map ipdptp0 10.0.0.0/24 -> 158.152.24.143/32 portmap tcp/udp
10000:40000

>rdr ipdptp0 158.152.24.143/32 port 25 -> 10.0.0.11 port 25

I don't see any reason why that shouldn't wok although you may need
the "rdr" line before the "map" line.  ipfilter is often sensitive
about ordering.

>Indeed, if I try 'telnet 158.152.24.143 25' on the NAT
>box, I should expect to find myself connected to port
>25 on the mail server, right? In fact, I get a "connection
>refused".

That won't work because the connection is made locally and isn't
appearing on the ipdptp0 interface.  To test this properly, you'll
need to arrange to do the telnet from outside your network.

>All suggestions gratefully accepted.

You could run snoop on the dial-up and local network interfaces to see
whether packets are being redirected.

Another solution would be to use a connection proxy such as plug-gw
from http://www.tis.com/research/software/fwtk_over.html

Regards, Mike.

-- 
Solaris on Intel: http://www.kempston.net/solaris/
PGP public key available by mail from pgp@kempston.net