RE: [Security Firewall] Problem with port forwarding

Assuming your LAN is using NAT, none of these will work because you have to
specify the public IP in the forward portion of the DNAT rule.  (it has to
know where to listen)

Here is a rule that we use to gain SSH into a linux box within the lan from
the wan (where xxx is your public IP)

DNAT    wan      lan:192.168.69.3       tcp     ssh     -
xxx.xxx.xxx.xxx

ftp and ftp-data would be the same.  Be sure and remove those other rules.

Jim

-----Original Message-----
From: security-firewall-owner-4qZELD6FgxheH41UXmfQsti2O/[email protected]
[mailto:security-firewall-owner-4qZELD6FgxheH41UXmfQsti2O/[email protected]] On Behalf Of ibon M. B.
Sent: Tuesday, June 14, 2005 2:31 PM
To: security-firewall-4qZELD6FgxheH41UXmfQsti2O/[email protected]
Subject: Re: [Security Firewall] Problem with port forwarding

thanks.
yes, i´ve tried to connect from an external machine using the public ip, and
the sniffer does not detect any conecction on port 21 in the ftp server.

these are the rules i´ve created (i´ve tried any possible variation):
ACCEPT wan fw tcp ftp -
ACCEPT wan fw tcp ftp-data -
DNAT wan lan:192.168.1.101 tcp ftp - all
DNAT wan lan:192.168.1.101 tcp ftp-data - all

i´ve also tried:

ACCEPT wan lan tcp ftp -
ACCEPT wan lan tcp ftp-data -
DNAT wan lan:192.168.1.101 tcp ftp - all
DNAT wan lan:192.168.1.101 tcp ftp-data - all

and:

ACCEPT wan fw tcp ftp -
ACCEPT wan fw tcp ftp-data -
ACCEPT wan lan tcp ftp -
ACCEPT wan lan tcp ftp-data -
DNAT wan lan:192.168.1.101 tcp ftp - all
DNAT wan lan:192.168.1.101 tcp ftp-data - all



>From: Neill Mitchell <[email protected]>
>Reply-To: security-firewall-4qZELD6FgxheH41UXmfQsti2O/[email protected]
>To: security-firewall-4qZELD6FgxheH41UXmfQsti2O/[email protected]
>Subject: Re: [Security Firewall] Problem with port forwarding
>Date: Tue, 14 Jun 2005 13:18:49 +0000
>
>One thing to try to eliminate certain things. Have you tried to connect
>to the ftp machine from an external machine? I assume you have the NAT
>all configured correctly for this machine (i.e. you are not trying to
>access it externally via its internal address)?
>
>Cheers
>On Tuesday 14 Jun 2005 10:06, ibon M. B. wrote:
> > Thanks for your help
> > I have created a custom rule to forward the ftp traffic to a
> > computer in
>my
> > lan, but port forwarding doesn´t seem to work.
> > Custom Rule:
> > Result --DNAT
> > Predefined Services--FTP
> > Protocol--FTP
> > Client:WAN
> > Server:LAN 192.168.1.100
> > Forwarding Address:all
> >
> > i can connect the ftp server inside the lan, but not outside.
> > any ideas?
> >
> >
> >
> >
> >
> > ____________________________________________________________________
> > _ This message has been checked for all known viruses by Minuco
> > delivered through the MessageLabs Virus Scanning Service. For
> > further infomation visit http://www.minuco.com or alternatively mail
> > [email protected]
>
>--
>Best regards
>Neill Mitchell
>
>Minuco Vigilize
>31 Museum Street, London, WC1A 1LG
>
>T: +44 (0)20 7692 2649
>F: +44 (0)20 7436 9955
>
>http://www.minuco.com <http://www.minuco.com/>
>
>You have received this e-mail from Minuco. It is intended to be read by
>the addressee because it could contain confidential and privileged
>information (including any attachments). If you are not the person or
>organisation this e-mail was intended for please return it to the
>sender and delete it from your computer(s). You must not copy,
>distribute, disclose, or disseminate the contents of this e-mail or its
>attachments to any third party unless authorised by Minuco.
>
>It is the responsibility of the recipient to ensure that the
>forwarding, opening or use of the e-mail (and any attachments) will not
>adversely affect their systems or data. Please carry out appropriate virus
checks.
>
>All rights reserved. The intellectual property in this e-mail and any
>attachments are vested solely in Minuco.
>

____________________________________________________
Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com
Join the Club : http://www.mandrakeclub.com
____________________________________________________