Subject: plug-gw /pop

From: [email-masked] (Stefan Heim, Dipl.-Ing.)
Date: Wed, 19 Jan 2000 18:40:42 -0800

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hello,

I want to use the plug-gw to contact an external pop-server via
Firewall (TIS) from clients in the  protected network.
The configuration is an the Firewall:
/etc/services:

pop-gw  2009/pc # Firelled POP3 Service

/etc/inetd.conf:

pop-gw  stream tcp nowait root  /usr/local/etc/plug-gw plug-gw 2009

netperm-table:

plug-gw:        permit-hosts 134.60.9.199
plug-gw:        port 2009 134.69.9.147 -plug-to mailserver.tz.de -port 110

Netscape-Mail on the machine 134.60.9.199:

Pop-Server: proxy.dom.de:2009

The read from mails not works:

/var/adm/messages:

localhost plug-gw[...]: deny host=......../134.60.9.199 service=pop-gw

What is wrong ?
Thanks!

/--------------------------------o00-----00o-------------------------\
Stefan Heim

Uni Ulm
Sektion Informatik in der Psychotherapie
Am Hochstraess 8
89081 Ulm
Germany
E-Mail: [email-masked]
http://sip.medizin.uni-ulm.de
Tel: +49-(0)731-50-25702 Fax: +49-(0)731-50-25662
\-------------------------------ooo0-----0ooOo---------------------/

---

From: Torsten Johr <[email-masked]>
Date: Wed, 19 Jan 2000 21:31:12 +0100

Hi Stefan!

/etc/services and /etc/inetd.conf seem to be okay.
But there is no "permit host" attribute for plug-gw. So, you should 
change the entry in your netperm-table from

> plug-gw:  port 2009 134.69.9.147 -plug-to mailserver.tz.de -port 110

to

plug-gw: port 2009 134.60.9.199 -plug-to mailserver.tz.de -port 110

         ---------------------- <- this is your access rule, meaning
connections from port 2009 at host 134.60.9.199 are allowed.

Good luck!

       Torsten

---------------------------------------------------------------

Torsten Johr                              Tel. +49 30 2090 3844
Sat.1 SatellitenFernsehen GmbH            Fax: +49 30 2090 3877
Abt. EDV/Systeme
Jaegerstr. 32                      E-Mail: [email-masked]
10117 Berlin

---------------------------------------------------------------

---

From: Michel Bardiaux <[email-masked]>
Date: Thu, 20 Jan 2000 09:24:38 +0100

"Stefan Heim, Dipl.-Ing." wrote:
[snip]
> plug-gw:        port 2009 134.69.9.147 -plug-to mailserver.tz.de -port 110

Should it not be "port 2009 134.60.9.199 ..."?

Greetings.
-- 
Michel Bardiaux
UsrConsult S.P.R.L.  Rue Margot, 37  B-1457 Nil St Vincent
Tel : +32 10 65.44.15  Fax : +32 10 65.44.10

---

From: Markus Schreier <[email-masked]>
Date: Thu, 20 Jan 2000 09:24:23 +0100

Hi Stefan,
Perhaps it helps if you put -dest * in the rule. So that it looks like the
folowing:
plug-gw:        permit-hosts 134.60.9.199 -dest *
This helped me with tn-gw some time.
Please let me know the result.

Greetings from Paderborn
Markus

---

From: "Chris Chavez" <[email-masked]>
Date: Sat, 22 Jan 2000 00:26:04 -0800

Hello All,

I am having the Identical problem as Stefan.  My configuration is Identical
except the top permit-hosts line which I did add in to no avail, I have
tried the three possible resolutions that were suggested and I continue to
get "deny host" in the log.  Any suggestions are very much appreciated?
Have a fine day.

Chris Chavez

-----Original Message-----
From:	[email-masked] [mailto:[email-masked]] On
Behalf Of Stefan Heim, Dipl.-Ing.
Sent:	Wednesday, January 19, 2000 6:41 PM
To:	[email-masked]
Subject:	plug-gw /pop

[To be removed from this list send the message "unsubscribe fwtk-users" in
the
BODY of a mail message to [email-masked].]

Hello,

/etc/inetd.conf:

netperm-table:

/var/adm/messages:

What is wrong ?
Thanks!

Uni Ulm

---

From: Ted Keller <[email-masked]>
Date: Sat, 22 Jan 2000 10:24:19 -0500 (EST)

Seems to me - we should really put this in a faq..... unless it is already
there....

There are three files which need to be maintained when setting up any type
of plug-gw service.

1. /etc/services

2. /etc/inetd.conf

3. netperm-table

The /etc services should list by name all ports which are to be used in
the plug-gw application.  If you are mapping ports between a private port
and a standard port - it is advisable to list both of them there.  For
example....

pop-3	110/tcp		#standard pop-3 port

pop-3-client	2110/tcp	#Private pop-3 port for proxying

Note - if both the internal and external ports are the same - only one
entry is required.

In this example, we will assume that a pop client will connect on
pop-3-client and link to a pop server at its standard port.

To do this - then set up an inetd entry as follows....

pop-3-client  stream  tcp  nowait  root   /usr/local/sbin/plug-gw pop-3-client

When something connects to the pop-3-client port (2110), the plug-gw
program will be run - and passed the parameter pop-3-client.

Now - in the netperm-table, you supply the parameters listed with the
service pop-3-client.  They will look something like.....

pop-3-client: timeout 3600
pop-3-client: port pop-3-client <conn hosts> -plug-to <rmt host> -port 
                 pop-3

When seeing a connection from conn hosts, create a connection to remote
host at port pop-3.

I think this should be close (did it from memory).

ted keller