Re: Redirecting ports & DHCP Question ** Resolved

[Matthew Kopishke <matt@kopishke.org>]

I figured out my problems, so I thought I would share with the group 
(if you wanted to know or not :))

For dhcp I ended up using tcpdump and listening to each interface, and 
then logging all the dropped packets to figure out where things where 
getting stuck.  I found out that the router was in fact (or as far as I 
can tell) was answering the DHCP requests (our service is provided by 
the state university, so we are a bit in the dark on anything out side 
our own networks).  So that was just a matter of opening up the right 
ports from the router's IP and dhcp was doing it's thing.

Now for the port/IP redirecting.  I read everything I could find about 
NAT in netfilter, and felt pretty strongly that what I was doing should 
be working, but after a couple of hours of playing I couldn't get it to 
work.  Come to find out in order for NAT to work, or at least IP 
forwarding, the device in question needs to have an IP  and routing set 
up.  After I did that every thing worked like a charm.

So now my firewall has an IP, which isn't the end of the world, I'll 
just have to take extra care when I "harden" the box.

Thanks!

Matt

On Friday, June 6, 2003, at 11:15  AM, Matthew Kopishke wrote:

> Hello folks.
>
> I have set up a bridging firewall using iptables (2.4.19) and have a 
> quick couple of questions.
>
> Before I ask my questions I just feel the need to say that the 
> bridging and firewalling code (in this case I mean when the two are 
> used together) has matured quite nicely.  I set up a firewall a year 
> or two ago using 2.2.X/ipchains with brcfg, which at the time seemed a 
> bit like black magic. :)
>
> Anyway, the first question is I have a Squid Proxy server running on 
> port 13001 doing some caching/filtering.  I was wondering, if it's 
> possible to just have my firewall redirect port 80 to port 13001?  It 
> seems posable, but browsing the man page I didn't find anything that 
> jumped out at me (well there was some NAT stuff, but this isn't a > NAT).
>
> The other question is one that I'm just having trouble tracking down 
> ports on.  We get our IPs via DHCP from a server outside our network 
> and there for out side the firewall.  I can't seem to be able to open 
> up the holes I need to let the DHCP request/responses flow through.  
> What I have done is open up port 67 & 68 to 0/0, I think that's the 
> first part of the equation, but I'm not sure what the second is.  I'm 
> going to keep wading through the DHCP documentation, but if some who 
> has been there and done that would be so kind...
>
> Thanks,
>
> Matt
>
>
> --
> To UNSUBSCRIBE, email to debian-firewall-request@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact 
> listmaster@lists.debian.org