[4107] in RedHat Linux List
masq/dns help (was Re: Alternative to IP Masquerade?)
daemon@ATHENA.MIT.EDU (David A. Mintz)
Tue Nov 12 17:46:48 1996
Date: Tue, 12 Nov 1996 17:31:33 -0500
To: Anthony Martin <amartin@engr.csulb.edu>
From: "David A. Mintz" <dmintz@csgsco1.prcrsi.com>
Cc: masq@indyramp.com, redhat-list@redhat.com
Resent-From: redhat-list@redhat.com
Reply-To: redhat-list@redhat.com
At 12:14 PM 11/8/96 -0800, you wrote:
>IP Masquerade works great, I use it myself, but there are a few things
>that would be difficult to figure out without guidance. Have you seen the
>IP Masquerade mini-HOWTO? You can find it at:
>http://www.ssc.com/linux/howto.html
>and a number of other places. If you follow the instructions there
>carefully, it should work fine.
>
>Tony.
Hello Tony,
I was wondering if you could help me... I was able to get IP Masq working
using actual ip addresses (ftp, http, telnet) but can't seem to figure out
how to get DNS working through the firewall. Have you been able to set that
up as well?
Is there any trick to the DNS part?
I have read the mini-faq, but with no luck.
Specifically what I am trying to do is this:
I have a number of clients on an internal net 192.168.1. I have a Linux/DNS
server (192.168.1.1) on this internal net. I also have a local external DNS
server (199.201.151.1). What I would like to do is have all of my internal
clients hit my internal DNS 192.168.1.1 and have it send unknown requests to
the external DNS server 199.201.151.1 through the Firewall machine
192.168.1.4/199.201.151.4.
To test whether DNS is working, I have been using nslookup on the internal
DNS machine which has a forwarder reference pointing to my external DNS
machine. When I type server 199.201.151.1 (which is my external dns server)
it can't reach through the firewall. Also, I don't see it trying via
tcpdump either.
I have been trying to use the following commands: ( I will only list the
one's pertaining to DNS)
IPFW="/sbin/ipfwadm"
echo "Add forwarding rules for nameserver"
$IPFW -F -a masquerade -P udp -V 192.168.1.4 -S 192.168.1.1 53 -D
0.0.0.0/0 53
echo "Add input rule for nameserver -> me"
$IPFW -I -a accept -P udp -S 192.168.1.1 53 -D 192.168.1.4
echo "Add input rule for Internet -> nameserver (masqueraded)"
$IPFW -I -a accept -P udp -S 0.0.0.0/0 53 -D 199.201.151.4
echo "Add input rule for nameserver -> Internet (will masquerade)"
$IPFW -I -a accept -P udp -S 192.168.1.1 53 -D 0.0.0.0/0 53
echo "Add output rule for me -> nameserver"
$IPFW -O -a accept -P udp -S 192.168.1.4 -D 192.168.1.1 53
echo "Add output rule for nameserver -> Internet"
$IPFW -O -a accept -P udp -S 199.201.151.4 -D 0.0.0.0/0 53
echo "Add output rule for Internet -> nameserver (masqueraded)"
$IPFW -O -a accept -P udp -S 0.0.0.0/0 53 -D 192.168.1.1 53
And finally, here is a ipfwadm listing of my current rules:
Firewall Rules:
IP firewall forward rules, default policy: deny
type prot source destination ports
acc/m udp int-dns anywhere domain -> domain
acc/m tcp internal-net/24 anywhere any -> any
IP firewall input rules, default policy: deny
type prot source destination ports
acc udp int-dns firewall_internal domain -> any
acc udp anywhere firewall_external domain -> any
acc udp int-dns anywhere domain -> domain
acc tcp anywhere firewall_external any -> smtp
acc tcp anywhere firewall_external ftp-data -> 1024:65535
acc tcp anywhere firewall_external any -> any
acc tcp internal-net/24 anywhere any -> any
IP firewall output rules, default policy: deny
type prot source destination ports
acc udp firewall_internal int-dns any -> domain
acc udp firewall_external anywhere any -> domain
acc udp anywhere int-dns domain -> domain
acc tcp firewall_external anywhere any -> any
acc tcp anywhere internal-net/24 ftp-data -> 1024:65535
acc tcp anywhere internal-net/24 any -> any
IP accounting rules
IP masquerading entries
Btw, I am using Redhat Linux 3.03 (Picasso) upgraded to kernel 2.0.14.
Just wondering if you might see something obvious...
Thanks in advance.
------------------------------------------------------
David Mintz |
Senior Systems Analyst/Systems Administrator |
Interealty Corp. |
dmintz@prcrsi.com |
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
________________________________________________________________________
http://www.redhat.com/RedHat-FAQ http://www.redhat.com/RedHat-Errata
http://www.redhat.com/RedHat-Tips http://www.redhat.com/mailing-lists
------------------------------------------------------------------------
To unsubscribe: mail -s unsubscribe redhat-list-request@redhat.com < /dev/null
