Subject: http-gw slow with IE but not NS

From: "Keith V. Olson" <[email-masked]>
Date: Tue, 17 Oct 2000 21:22:22 -0700

Hello,

I just recently installed fwtk on a Redhat Linux 6.1 486
with 16M memory.  I having problems with http-gw being
very slow in general, but extremely slow to non-functioning
when I use IE as the browser.  From the same machine when
I use NS it's slower than going directly to the web server,
but still reasonable.

The http-gw lines from my netperm-table:

http-gw:        userid                  root
http-gw:        timeout                 3600
http-gw:        default-httpd   	192.168.1.5
http-gw:        hosts                   * -log { read write ftp }
http-gw:        deny-hosts              unknown

The http line from /etc/inetd.conf:

http stream tcp nowait root /usr/local/etc/http-gw http-gw

The firewall is 192.168.1.1, the intranet DNS and webserver
are on 192.168.1.5 and the computer I'm browsing from is
192.168.1.4.  The DNS is correctly setup in the /etc/resolv.conf
on the firewall and nslookup is ok.  

Attached is the lines for the IE download of a webpage.  It takes
bout 5 seconds directly to the webserver or 15 seconds
in NS.  IN IE it takes about 3 minutes and still some of the
graphics don't download.

Keith
-- 
                             ///\\
                             (O O)
                +--------oOO--(_)-------------+
                | Keith V. Olson              |
                | [email-masked] |
                | http://www.digmanolson.com/ |
                +------------------oOO--------+
                  Portland  |__|__|        <*>
                  Oregon     || ||      MTFBWY
                            ooO Ooo

Oct 17 21:11:49 irvington http-gw[12881]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1)
Oct 17 21:11:49 irvington http-gw[12881]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/frames.html
Oct 17 21:11:50 irvington http-gw[12882]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1)
Oct 17 21:11:50 irvington http-gw[12882]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/homepage.html
Oct 17 21:12:06 irvington http-gw[12881]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17
Oct 17 21:12:06 irvington http-gw[12883]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1)
Oct 17 21:12:06 irvington http-gw[12883]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/toc.html
Oct 17 21:12:07 irvington http-gw[12882]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17
Oct 17 21:12:07 irvington http-gw[12884]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1)
Oct 17 21:12:07 irvington http-gw[12884]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/crinklep.jpg
Oct 17 21:12:23 irvington http-gw[12883]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17
Oct 17 21:12:23 irvington http-gw[12885]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1)
Oct 17 21:12:23 irvington http-gw[12885]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/xmasdog.jpg
Oct 17 21:12:24 irvington http-gw[12884]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17
Oct 17 21:12:24 irvington http-gw[12886]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1)
Oct 17 21:12:24 irvington http-gw[12886]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/wedding.gif
Oct 17 21:12:40 irvington http-gw[12885]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17
Oct 17 21:12:40 irvington http-gw[12887]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1)
Oct 17 21:12:40 irvington http-gw[12887]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/globeani.gif
Oct 17 21:12:41 irvington http-gw[12886]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17
Oct 17 21:12:41 irvington http-gw[12888]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1)
Oct 17 21:12:41 irvington http-gw[12888]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/leftbtns.gif
Oct 17 21:12:57 irvington http-gw[12887]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17
Oct 17 21:12:57 irvington http-gw[12889]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1)
Oct 17 21:12:57 irvington http-gw[12889]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/home.gif
Oct 17 21:12:58 irvington http-gw[12888]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17
Oct 17 21:12:58 irvington http-gw[12890]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1)
Oct 17 21:12:58 irvington http-gw[12890]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/newspapr.gif
Oct 17 21:13:14 irvington http-gw[12889]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17
Oct 17 21:13:14 irvington http-gw[12893]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1)
Oct 17 21:13:14 irvington http-gw[12893]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/pennote.gif
Oct 17 21:13:15 irvington http-gw[12890]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17
Oct 17 21:13:15 irvington http-gw[12894]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1)
Oct 17 21:13:15 irvington http-gw[12894]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/hacker.gif
Oct 17 21:13:31 irvington http-gw[12893]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17
Oct 17 21:13:31 irvington http-gw[12895]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1)
Oct 17 21:13:31 irvington http-gw[12895]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/emailk.gif
Oct 17 21:13:32 irvington http-gw[12894]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17
Oct 17 21:13:32 irvington http-gw[12896]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1)
Oct 17 21:13:32 irvington http-gw[12896]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/snow2.gif
Oct 17 21:13:48 irvington http-gw[12895]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17
Oct 17 21:13:48 irvington http-gw[12897]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1)
Oct 17 21:13:48 irvington http-gw[12897]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/star.gif
Oct 17 21:13:49 irvington http-gw[12896]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17
Oct 17 21:13:49 irvington http-gw[12898]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1)
Oct 17 21:13:49 irvington http-gw[12898]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/rnew.gif
Oct 17 21:14:05 irvington http-gw[12897]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17
Oct 17 21:14:05 irvington http-gw[12900]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1)
Oct 17 21:14:05 irvington http-gw[12900]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/updated.gif
Oct 17 21:14:06 irvington http-gw[12898]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17
Oct 17 21:14:06 irvington http-gw[12901]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1)
Oct 17 21:14:06 irvington http-gw[12901]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/emailc.gif
Oct 17 21:14:22 irvington http-gw[12900]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17
Oct 17 21:14:22 irvington http-gw[12903]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1)
Oct 17 21:14:22 irvington http-gw[12903]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/docs.gif
Oct 17 21:14:23 irvington http-gw[12901]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17
Oct 17 21:14:23 irvington http-gw[12904]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1)
Oct 17 21:14:23 irvington http-gw[12904]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/mail1.gif
Oct 17 21:14:39 irvington http-gw[12903]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17
Oct 17 21:14:39 irvington http-gw[12905]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1)
Oct 17 21:14:39 irvington http-gw[12905]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/www.gif
Oct 17 21:14:40 irvington http-gw[12904]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17
Oct 17 21:14:56 irvington http-gw[12905]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17

---

From: Rick Murphy <[email-masked]>
Date: Wed, 18 Oct 2000 06:09:27 -0400

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

>I use NS it's slower than going directly to the web server,

Disable HTTP/1.1 in IE and try again. (That's on the Tools/Internet Options 
page, Advanced Tab, HTTP 1.1 Settings. Unclick "Use HTTP 1.1 through proxy 
connections".

You have both browsers set up to use the firewall as a proxy, correct?
         -Rick

---

From: "Keith V. Olson" <[email-masked]>
Date: Wed, 18 Oct 2000 08:03:42 -0700 (PDT)

> page, Advanced Tab, HTTP 1.1 Settings. Unclick "Use HTTP 1.1 through proxy 

That option was unselected.  Selecting it and trying the connection again 
didn't seem to change the performance.

> You have both browsers set up to use the firewall as a proxy, correct?

This might be a problem with my understanding of proxy-ing.  I don't want
to proxy outgoing connections.  Just connections incoming on port 80 of
the firewall.  To test this I've been hitting port 80 from another computer
inside the firewall.  I think that is a valid test.
 
Maybe I shouldn't be using http-gw? Would plug-gw be better?

Keith

                             ///\
                             (O O)

---

From: Rick Murphy <[email-masked]>
Date: Wed, 18 Oct 2000 17:58:00 -0400

>Maybe I shouldn't be using http-gw? Would plug-gw be better?

If you are intending to proxy inbound, untrusted users to your web site, 
don't use http-gw. Use plug-gw instead. The http-gw has far more 
functionality than you need, some of which can be exploited by untrusted users.
         -Rick

---

From: "Keith V. Olson" <[email-masked]>
Date: Wed, 18 Oct 2000 22:43:26 -0700

Humm, reading item 2.4.13 in the fwtk faq makes more sense
now.  So is http-gw meant specifically for outbound traffic?
The documentation seems a little vague.  The other proxies
seem to be for both inbound and outbound.

Thanks for the plug-gw tip.

One more question.  About that faq item (2.4.13), there is a
statement... "Your best bet for this is to use a plug-gw;
however, that will not protect the web server from penetration
attempts."  I had thought the purpose of proxy-ing an inbound
connection was to 'plug' a hole in the firewall and prevent a
root access type attack against the internal server running
the webserver?  If not then what's the difference,
security-wise, between using a proxy and using port
forwarding?

Keith

---

From: Keith Young <[email-masked]>
Date: Thu, 19 Oct 2000 08:40:51 -0400

> security-wise, between using a proxy and using port

What I was trying to say in the FAQ is that if someone finds a hole in
your web server and it is on your inside network, then they will have
access to your network. The plug proxy cannot protect against bugs in
web servers or CGI scripts.

You may want to consider putting the web server in a DMZ (third network
interface of your firewall box). This will have the firewall protect the
server from the Internet, and will also force attackers to break through
the firewall in order to get to the inside network.

-- 
--Keith Young
-Director of Customer Care/Support, V-ONE Corp.
[email-masked]