Subject: tn-gw permissioning

From: "Dameon" <[email-masked]>
Date: Fri, 18 Feb 2000 14:40:43 EST

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hello!

Say I've got this permission file for a 2.1 tn-gw and netacl on solaris 
2.6...

Imagine a filtered backbone with two machines that should be accessible in 
the backbone, also also other machines in the greater network.

Plug in your standard rules:
  netacl-tn-gw:   permit-hosts 127.0.0.1  -exec /opt/fwtk21/tn-gw
  netacl-tn-gw:   permit-hosts a.b.*   -exec /opt/fwtk21/tn-gw
  tn-gw:  denial-msg      /opt/fwtk21/txt/tn-deny.txt
  tn-gw:  denydest-msg    /opt/fwtk21/txt/tn-denydest.txt
  tn-gw:  welcome-msg     /opt/fwtk21/txt/tn-welcome.txt
  tn-gw:  help-msg        /opt/fwtk21/txt/tn-help.txt
  tn-gw:  timeout 7200
  tn-gw:  prompt "gw1 tn-gw-> "

Ok, now we add some rules.  This is the ideal:
  tn-gw: hosts * -dest x.y.z.20
  tn-gw: hosts * -dest x.y.z.21
  tn-gw: hosts * -dest !x.y.z.*
  tn-gw: hosts * -dest x.y.*

With some experimentation, I find one set of allow and deny destinations per 
"*" source match seems to be allowed.  ie, only:
  tn-gw: hosts * -dest x.y.z.20 -dest x.y.z.21 -dest !x.y.z.* -dest x.y.*

The problem is that I have way too many hosts that I need to list and the 
line becomes too long.  Then I get the message:
  fwtkcfgerr: /opt/fwtk21/netperm-table line 16 too long

Any ideas?

______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com