[95630] in RedHat Linux List
success: port forwarding
daemon@ATHENA.MIT.EDU (Michael Jinks)
Tue Oct 20 00:47:21 1998
Date: Tue, 20 Oct 1998 04:36:46 +0000
From: Michael Jinks <michael@twopoint.com>
To: redhat-list@redhat.com
Resent-From: redhat-list@redhat.com
Reply-To: redhat-list@redhat.com
I'm posting this because I've seen/been part of three or four different
conversations on this list in the past couple of weeks that involved
port forwarding, I've just achieved a measure of success, and I thought
I'd share, in the hope that someone else will benefit. I'm a rank
amateur, so beware that anything I describe may be exactly the wrong
thing for you to do yourself, but so far it's working for me.
We have a private net which hides behind a masqing firewall, which is
fine except that some of our users wanted to read their in-house mail
while connected to the internet through their personal ISP's. All of
those users are on Win95 most of the time, so ssh (or something similar)
was out of the question, as was the use of some alternate port for
accessing POP or IMAP; the Win95 clients just aren't that flexible.
Originally I had planned to add an aliased IP address to the external
NIC on our firewall, and use that interface for those inbound POP/IMAP
connections. I have yet to make that work, and I don't know why; word
from the guy who wrote the port forwarding docs (and I believe also the
ipportfw utility) is that while success with forwarding ports from
aliased interfaces has been reported, he's never gotten it to work. He
didn't say why and I doubt that I'd understand the explanation anyhow.
Since our firewall doesn't house a POP or IMAP server, using its main
interface for this was an acceptable (if less than ideal) option, but I
did have to make two changes to my setup.
First, in the firewall's /etc/services, I made sure that the POP3 and
IMAP ports were not being bound to processes on the local host by adding
a trailing 0 to their port numbers. I do not know for sure that this is
a good idea, but it worked and so far has not bitten me.
Second, I added two -I rules to my ipfwadm setup to open ports 110 (for
POP3) and 143 (for IMAP) on the external interface. Inbound packets
were being denied previous to this.
After those two adjustments were made, two ipporfw commands to move
ports 110 and 143 from the external interface to the IP address of our
internal mail server worked like a charm.
I would welcome any critiques or stories from anybody else who is trying
something similar to this. In particular, I would really like to get
this working on an aliased interface. But this works for now, and I
think my users are fresh out of complaints about the inconvenience of
our security policy.
Cheers,
m
--
Michael Jinks
mailto:michael@twopoint.com http://www.twopoint.com
Systems Administrator, Two Point Conversions, Inc.
"Push the button." -- Pitr
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
http://www.redhat.com http://archive.redhat.com
To unsubscribe: mail redhat-list-request@redhat.com with
"unsubscribe" as the Subject.
