Subject: Udp relay

From: "Jeroen" <[email-masked]>
Date: Wed, 12 Jan 2000 00:32:04 +0100

Hi everyone,
 
Can enyone help me to get a WORKING copy of udp relay for my tis firewall ??
Need to have DNS lookups for my exchange server and web server in the DMZ 
I run my firewall on Redhat 6.0
 
Tanks in advance 

                                     Jeroen de Bruin.

---

From: [email-masked]
Date: Tue, 11 Jan 2000 18:04:33 +0300

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

-----BEGIN PGP SIGNED MESSAGE-----

nuqneH,

UDPrelay does not handle heavy load (many active rules) well.
I suggest using a forward-only named (8.x) bound to internal interface.

"Jeroen" <[email-masked]> said :

> [To be removed from this list send the message "unsubscribe fwtk-users" in the
> BODY of a mail message to [email-masked].]
> 
> This is a multi-part message in MIME format.
> 
> ------=_NextPart_000_002A_01BF5C94.733C9A90
> Content-Type: text/plain;
> 	charset="iso-8859-1"
> Content-Transfer-Encoding: quoted-printable
> 
> Hi everyone,
> =20
> Can enyone help me to get a WORKING copy of udp relay for my tis =
> firewall ??
> Need to have DNS lookups for my exchange server and web server in the =
> DMZ=20
> =20
> Tanks in advance=20

                                     _     _  _  _  _      _  _
 {::} {::} {::}  CU in Hell          _| o |_ | | _|| |   / _||_|   |_ |_ |_
 (##) (##) (##)        /Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|
 [||] [||] [||]            Do i believe in Bible? Hell,man,i've seen one!

---

From: Joseph S D Yao <[email-masked]>
Date: Thu, 20 Jan 2000 12:12:55 -0500

> I run my firewall on Redhat 6.0

Using udprelay at all increases your risk.  Named itself can be a good
proxy.  Set your internal DNS to forward [in "forward only" mode] to
your firewall bastion host.  If you don't want to respond to external
queries, set your firewall 'named' to only listen to the internal
network(s) and 127.0.0.1.

The current version of BIND, with many security fixes, is 8.2.2-P5,
available at ftp.isc.org [or www.isc.org if you are so oriented].

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.