On Sunday 02 February 2003 23:52, Togan Muftuoglu wrote:

* Marc Christensen; on 02 Feb, 2003 wrote:

...

I have a machine with two interfaces, eth0, eth1. eth0 is external, eth1 is masq (192.168.1.0/24). I want to be able to access some specific services running on the external interface from the internal, masqueraded network:

So you want to reach your external interface from your internel network. This is not possible without tweaking FW_CUSTOM to enable such access as SuSEfirewall2 by default denies these requests.

Yes, this is what I want to do. From the EXAMPLE file item #9, it states (emphisis on the words 'on the firewall' not mine): # 9.) # Which services ON THE FIREWALL should be accessible from either the internet # (or other untrusted networks), the dmz or internal (trusted networks)? # (see no.13 & 14 if you want to route traffic through the firewall) XXX ... From what I understand, services running on the firewall listed in the variables FW_SERVICES_INT_TCP, FW_SERVICES_INT_UDP and FW_SERVICES_INT_IP should be accessable from the internal network.

...

Despite listing services in FW_SERVICES_INT_(TCP|UDP)=, I am still getting denied when trying to access the services from the internal network. Anyone have any ideas?

Can you reach those services from the internal interface by tying the address of the internal interface

I imagine that you ment to say "typing" instead of "tying". Yes, all services are accessabe via the 192.168.1.xxx IP address on the gateway. However, I want to be able to have my clients enter in FQDNs for the different services. ie. for access to: Service FQDN ------- ---- squid proxy proxy.domainname.com:8080 ntp ntp.domainname.com gw gw.domainname.com DNS ns.domainname.com imap/pop/smtp mail.domainname.com etc. These DNS entries are all valid and either CNAMES or A records for the real-world server IP. Being able to put in FQDNs in for these services is important because it allows new servers to be installed to take on the above funcitons transparent to the clients. If I have them enter IPs for the internal masqueraded network, they will have to reconfigure their TCP/IP setup if one of these changes.

...

FW_MASQ_NETS="0/0"

You probably want to have this repseresenting your actual masquerading network ie 192.168.1.0/24

Yea, but since there are no other nets, it doesn't really matter but I was thinking the same thing... -- Marc Christensen http://www.mecworks.com http://www.mecworks.com/~marc/resume

On Monday 03 February 2003 00:39, Togan Muftuoglu wrote:

* Marc Christensen; on 03 Feb, 2003 wrote:

...

...

So you want to reach your external interface from your internel network. This is not possible without tweaking FW_CUSTOM to enable such access as SuSEfirewall2 by default denies these requests.

Yes, this is what I want to do. From the EXAMPLE file item #9, it states (emphisis on the words 'on the firewall' not mine):

SuSEfirewall2 will drop requests coming to the External address which have private addresses this is antispoofing. Th eonly way you can change this is adding your rules in the custom script "fw_custom_before_ antispoofing"

So, if I understand, a packet coming from a 192.168.1.xxx (non-routable IP address) to a real IP address will be dropped even if it is a trusted network? This is a pain...

iptables -A INPUT -i internal_int -s internal_net/mask -d external_int -j ACCEPT

you can add port numbers also so you will be limiting the behavior of this permission

Thanks...I'll look into this. [snip]

...

These DNS entries are all valid and either CNAMES or A records for the real-world server IP. Being able to put in FQDNs in for these services is important because it allows new servers to be installed to take on the above funcitons transparent to the clients. If I have them enter IPs for the internal masqueraded network, they will have to reconfigure their TCP/IP setup if one of these changes.

Taking into consideration that I have had only one cup of coffee yet, why don't you set a DNS for internal use only so your clients can still reach with FQDN internally

Yea, I thought of that as well. I just don't want to maintain two zone files, all duplicates when I should only have to maintain one. If I can't get the above custom rule set to work, I'll probably end up doing this. Thanks. -- Marc Christensen http://www.mecworks.com http://www.mecworks.com/~marc/resume