[Shorewall-users] Some IP''s does not respond

Per Krogh Nielsen
Thu, 15 May 2003 00:35:59 -0000

> >
> > And now the trouble :
> > ACCEPT          net             fw:192.168.2.4 tcp
> > 21,22,25,80,110,143,ftp-data
>
> ftp-data should NEVER be seen as a destination port.

OK.

>
> > I can''t get any response from the rule.
> > The above rules for exchange and termserver are working just fine.
> >
> > What am I doing wrong ?
>
> You are trying to use static NAT on a firewall internal
> address. Shorewall
> is designed to only handle static nat for local addresses
> that are NOT on
> the firewall. While I would have thought that it should "sort
> of" work, I
> would not be surprised if it doesn''t.

OK. That explains a lot.

> Several questions:
>
> a) Why don''t you just have the web server bind to 0.0.0.0 and
> forget NAT?
> You can use firewall rules to only accept WWW on
> 80.164.172.14 from the net
> and 192.168.2.4 from the local net. If you do that, you will
> have to get
> rid of a rule that you didn''t show us that is opening TCP port 80
> unconditionally from the net to the firewall.

This one ?
ACCEPT          net             fw              tcp     22,80
I did this to make the websites work while sorting out these problems.
The users access sites in form of http://80.164.172.1/<page> .


> b) Why are you ACCEPTing 21,22,25,110,143 (and ftp-data) if
> all you are
> running on the firewall is a web server?

It''s running proftp, postfix, and courier-imap/pop3 as well.
The ssh is for me only. I quess I should use the 80.164.172.1 instead.

>
> c) Do you REALLY want to run a web server on your firewall?
> While Apache
> has a pretty good security record, it isn''t perfect.

Well. It''s all I got. And the load will not be high. Some small sites,
and some company internal sites.

Perhaps I should grab an old workstation and make a firewall-only host of it.

> If you still want to keep your current setup then get rid of
> the nat file
> entry for 192.168.2.4 and replace your rule with this one:
>
> DNAT	net	fw:192.168.2.4	tcp	80	-	80.614.172.14

OK. I''ll try that after work hours. Thanks a lot.

Per Nielsen  :-)