Subject: set up server in the DMZ

From: wen <[email-masked]>
Date: Thu, 20 Jul 2000 9:4:45 +0800

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

hi:
standard port was used by module in  the fwtk.for example,http-gw has used 80 port,ftp-gw used 21 and 20 port,tn-gw used 23 port.if I set up a webserver in the DMZ,webserver must listen http request on other port,for example 8777 port.but  when clients in the internet want to browse my webserver, beacuse he don't know my webserver is listening on 8777 port,he can send out request with destination port 80. as result,http-gw receive this request and discard it.so he can not login my webserver.
what do I do to resolv this problem?

for this problem,in another words,it is said as : how should I set up a DMZ with fwtk?

thanks.

wen

---

From: Steve Sandau <[email-masked]>
Date: Thu, 20 Jul 2000 08:32:26 -0400

I believe that either fwtk needs to listen on port 80 for incoming www
connections and pass them to your DMZ WWW server (as mine does) OR, the
client on the Internet needs to know the alternate port that fwtk IS
listening on.

If you want to have fwtk listen on port 80 and pass the request to your
www server which is listening on port 8777, you can use plug-gw to plug
incoming port 80 to the www server, port 8777. The line in netperm-table
would look like this I think:

plug-gw:        port www * -plug-to 192.168.251.67 -port 8777

---

From: Scott McEachern <[email-masked]>
Date: Thu, 20 Jul 2000 11:17:53 -0400

> for this problem,in another words,it is said as : how should I set up a DMZ with fwtk?

    I have a setup just like what you need.  Basically you just switch the http-gw/www services around.  Here's what you do:
- create a line in /etc/services like this: "http-gw   8080/tcp"
- make sure you are using the ipbind patch, and have a line like this to start your http proxy: (mine is in /etc/rc.local): "/usr/local/etc/http-gw -daemon 192.168.0.1:http-gw &" where 192.168.0.1 is your internal NIC.
- have a line in your netperm-table like this: "http-gw: hosts 192.168.0.*" where 192.168.0.* is your internal (protected) network.  Now have all your internal machines use 192.168.0.1:8080 for http/security/ftp proxy, where your firewall is 192.168.0.1.
- In /etc/rc.local (or wherever you start the fwtk daemons) have: "/usr/local/etc/plug-gw -daemon www www &" (yes, www twice)
- in your netperm table, put "www: port 80 * -plug-to 192.168.1.2 -port 80" where the * is whatever _external_ addresses are allowed (as you can tell, I allow all, because I don't know who's going to hit my site), and the 192.168.1.2 is your DMZ'd web server.
    Now your internal users can surf, and external people can hit your web server.  Apply similar rules for other needed ports.  I wouldn't use tn-gw if I were you...go with ssh.

--
R. Scott McEachern, Network Administrator
J&A Media Services, Inc.
300 John St., Suite 500, Thornhill, ON, CA  L3T 5W4
tel:905-881-6902  fax:905-881-6945