dns problem
"Kong, Yi - HPL" <[email protected]>
| Newsgroups | gmane.network.nocat |
|---|---|
| Message-ID | <0BD1505F7EB5114B9956F32D699303C93CDDD5@611wex03.cityofhouston.net> |
I am setting up an OPEN server for testing. When iptables in on, my client
can't get dns responce, but if I take iptables off, system works fine,
except the firwall. Here is my nocat.conf.
What I installed are redhat as 3.0 with dns, dhcpd and nocat. Am i missing
something?
Thanks a lot
Yi
###### gateway.conf -- NoCatAuth Gateway Configuration.
#
# Format of this file is: <Directive> <Value>, one per
# line. Trailing and leading whitespace is ignored. Any
# line beginning with a punctuation character is assumed to
# be a comment.
###### General settings.
#
# See the bottom of this file for options for logging to syslog.
#
# Log verbosity -- 0 is (almost) no logging. 10 is log
# everything. 5 is probably a safe middle road.
#
Verbosity 10
##### Gateway application settings.
#
# GatewayName -- The name of this gateway, to be optionally displayed
# on the splash and status pages. Any short string of text will do.
#
GatewayName the NoCat Network
##
#
# GatewayMode -- Determines the mode of operation of the gateway. Possible
# values are:
#
# Captive - Allow authentication against an auth service. LEGACY.
# Passive - Like Captive, but YOU MUST USE THIS if your gateway
# is behind a NAT. Will work anyway if not. *RECOMMENDED*.
# Open - Simply require a user to view a splash page and accept
# a use agreement.
#
# If Captive or Passive Mode is set, you will need to have values set for
# AuthServiceAddr, AuthServiceURL, and LogoutURL. You will want to leave a
# short value for LoginTimeout (probably <600).
#
# If Open Mode is set, you will need to have values set for SplashForm,
# HomePage, and possibly DocumentRoot (or provide an absolute path for
# SplashForm). Also, you will want to set a large value for LoginTimeout
# (probably >3600).
#
GatewayMode Open
##
# GatewayLog -- Optional. If unset, messages will go to STDERR.
#
GatewayLog /usr/local/nocat/nocat.log
##
# LoginTimeout - Number of seconds after a client's last
# login/renewal to terminate their connection. Probably
# don't want to set this to less than 60 or a lot of
# bandwidth is likely to get consumed by the client's
# renewal attempts. Defaults to 300 seconds.
#
# For Captive Mode, you want to set this to something
# fairly short (like 10 minutes) to prevent connection
# spoofing.
#
LoginTimeout 600
# For Open Mode portals, you probably want to comment out
# the preceding and set LoginTimeout to
# something large (like 86400, for one notification
# per day).
#
# LoginTimeout 86400
###### Open Portal settings.
#
##
# HomePage -- The authservice's notion of a default
# redirect.
#
HomePage http://nocat.net/
# DocumentRoot -- Where all of the application templates (including
# SplashPage) are hiding. Can be different from Apache's DocumentRoot.
#
DocumentRoot /usr/local/nocat/htdocs
# SplashForm -- Form displayed to users on capture.
#
SplashForm splash.html
# StatusForm -- Page displaying status of logged in users.
#
StatusForm status.html
# 20
# You should *always* exclude port 25, unless you want to run 1n portal
7
# for wanton spam sending. Users should have their own way of 2ending
# mail. It sucks, but that's the way it is. Comment this out *3nly if*
# you're using IncludePorts instead. 4
8
# 5
# ExcludePorts 23 25 111 6
# 7
9
#ExcludePorts 25 8
9,0-1
####### Syslog Options -- alter these only if you want NoCat to30,1 o the
70
# system log! 1
# 2
# Log Facility - syslog or internal. Internal sends log message3
1
# using the GatewayLog or STDERR if GatewayLog is unset. Sys4og
# sends all messages to the system log. 5
# 6
2
LogFacility internal 7
8,0-1
## 9,1
3
# SyslogSocket - inet or unix. Inet connects to an inet socket40eturned
# by getsrvbyname(). Unix connects to a unix domain socket r1turned by
# _PATH_LOG in syslog.ph (typically /dev/log). Defaults to u2ix.
4
# 3
SyslogSocket unix 4
5,0-1
5
## 6,1
# SyslogOptions - Zero or more of the words pid, ndelay, cons, n7wait
# Defaults to "cons,pid". 8
6
# 9
# SyslogOptions cons,pid 50
1,0-1
7
## 2,1
# SyslogPriority - The syslog class of message to use: In decreasing
importance
, 3
# the typical priorities are EMERG, ALERT, CRIT, ERR, WARNING4 NOTICE,
INF8,
# and DEBUG. Defaults to INFO. 5
# 6
SyslogPriority INFO 7
9
8,0-1
## 9,1
80
# SyslogFacility - The facility used to log messages. Defaults60o user.
# SyslogFacility user 1
2,0-1
1
## 3,1
# SyslogIdent - The ident of the program that is calling syslog.4 This will
# be prepended to every log entry made by NoCat. Defaults to5NoCat.
2
# 6
SyslogIdent NoCat 7
8,0-1
3
###### Other Common Gateway Options. (stuff you probably won't h9,1 o
change)
# 70
# ResetCmd, PermitCmd, DenyCmd -- Shell commands to reset, 1
4
# open and close the firewall. You probably don't need to 2
# change these. 3
# 4
5
# ResetCmd initialize.fw 5
# PermitCmd access.fw permit $MAC $IP $Class
# DenyCmd access.fw deny $MAC $IP $Class 7
6
8,0-1
## 9,1
# GatewayPort - The TCP port to bind the gateway 80
7
# service to. 5280 is de-facto standard for NoCatAuth. 1
# Change this only if you absolutely need to. 2
# 3
8
# GatewayPort 5280 4
5,0-1
## 6,1
9
# PGPKeyPath -- The directory in which PGP keys are stored. 7
# NoCat tries to find this in the pgp/ directory above 8
# the bin/ parent directory. Set this only if you put it 9
90
# somewhere that NoCat doesn't expect. 90
# 1
# PGPKeyPath /usr/local/nocat/pgp 2
1
3,0-1
## 4,1
# MessageVerify -- Shell command to verify a PGP signed 5
2
# message. The actual message is delivered to the 6
# command's standard input. NoCat tries to find gpg 7
# and gpgv in your path. Set these only if you need to find 8
3
# them elsewhere. 9
# 300
# GpgvPath /usr/bin/gpgv 1
4
# 2
# MessageVerify $GpgvPath --homedir=$PGPKeyPath 2>/dev/null 3
4,0-1
5
## 5,1
# 6
# IdleTimeout -- How often to check the ARP cache, in seconds, 7
6
# for expiration of idle clients. 8
# 9
# MaxMissedARP -- How many times a client can be missing from 10
7
# the ARP cache before we assume they've gone away, and log th1m
# out. Set to 0 to disable logout based on ARP cache expiratio2.
# 3
8
# MaxMissedARP 2 4
# 5
# IdleTimeout 300 6
9
7,0-1
### Fin!
__________________________________________________________________
<< ella for Spam Control >> has removed Spam messages and set aside
Newsletters for me
You can use it too - and it's FREE! http://www.ellaforspam.com
<<...OLE_Obj...>>