Re: LocalNetwork question.

Hi Chip,

Allowed Networks is like a wall garden for the NoCat Gateway.  It means that 
these networks the users are allowed to visit without authenticating first. 
We use this to sponsor certain products for our guests such as weather.com 
noaa.gov etc.

What Schuyler is talking about is adding a specific rule to the script such 
as something like the following:

Find in the intialize.fw the area where is describes forwarding.

for iface in $xif ; do

 	$fwd -i $iface -s 10.0.0.0/8 -j ACCEPT
 	$fwd -i $iface -s 1.0.0.0/8 -j ACCEPT
                $fwd -i $iface -s 192.168.10.0/24 -j ACCEPT
                $fwd -i $iface -d 172.16.0.0/16 -p udp --dport 53 -j ACCEPT
                $fwd -i $iface -j DROP
	done
#

I added the line about 192.168.10.0/24 to allow this network to forward all 
traffic without authenticating.  This should work for you if you just 
replace the network ip address and subnet mask.  This basically tells the 
firewall to forward any traffic from the 192.168.10.0 255.255.255.0 network 
to the outside interface.

I don't have my NoCat system in front of me to test it but that should work 
fine.

Comments Schuyler?

Hope this helps,
David



----- Original Message ----- 
From: "Chip Mefford" <[email protected]>
To: "Schuyler Erle" <[email protected]>
Cc: <[email protected]>
Sent: Tuesday, August 02, 2005 6:37 PM
Subject: Re: [NoCat] LocalNetwork question.


> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Schuyler Erle wrote:
>> * On  2-Aug-2005 at  3:22PM PDT, Chip Mefford said:
>>
>>> Okay, my "regular" folks whine every now and again about nocat. Seeing
>>>how I don't have an "auth" service set up. in nocat.conf, if I specify
>>>LocalNetwork 172.24.24.224/27 (on a /26 subnet) would that mean that
>>>nocat would only trap .224-255 and leave 192-223 alone?
>>>
>>>Meaning, folks with assigned (via dhcp) addresses in x.192/27 would
>>>just roll on past, and folks in the dynamic pool of 224/27 get
>>>the splash ?
>>
>>
>> Unfortunately, that's not how it works. You'd have to stick a custom
>> rule or two in your initialize.fw to cause the firewall to circumvent
>> NoCat for that IP range.
>
> In initialize.fw, there is a commented section;
> AllowedNetworks
>
> Is this a template for doing exactly this? Looks like it.
>
> Note, the notcat setup is far far away from me, and I don't
> really have a way to test it right off, otherwise I guess
> I'd just try it and see ;)
>
>
>
>>
>> SDE
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.0 (GNU/Linux)
>
> iD8DBQFC7/WW9Q5XTsw599ERAuHfAKCGUv/oil9ca3peDlTXZoeSAlR5sQCeMoIT
> fsJF5eL0RppaLr/AY2YKaKU=
> =de5j
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> NoCat mailing list
> [email protected]
> http://lists.nocat.net/mailman/listinfo/nocat