Subject: plug-gw for unknown destination

From: Zakharov Mikhail <[email-masked]>
Date: Tue, 27 Feb 2001 02:20:55 -0800 (PST)

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hello, fwtk-users!

I have troubles with plug-gw. I need to configure it
for unknown desthosts. How can I do it?

plug-gw: port port_nb src_host -plug-to dest_host
-port dest_port_nb

^^^^^^^^ This works for one, two destination hosts
with plug-gw rule for itch. 

Is it possible to configure plug-gw that way:

plug-gw: port port_nb src_host -plug-to * -port
dest_port_nb

What can i do to run this type of rule?

Best regards
Mikhail

__________________________________________________
Do You Yahoo!?
Get email at your own domain with Yahoo! Mail. 
http://personal.mail.yahoo.com/

---

From: Ted Keller <[email-masked]>
Date: Tue, 27 Feb 2001 10:29:00 -0500 (EST)

Zakharov,

plug-gw is a many to one proxy - not a one to many or a many to many.

If your application needs to connect to many hosts - you may want to look
at socksifying the application and using a socks daemon for that purpose.
See www.socks.nec.com.

ted keller

---

From: Michel Bardiaux <[email-masked]>
Date: Wed, 28 Feb 2001 10:39:57 +0100

> at socksifying the application and using a socks daemon for that purpose.
Slight amendment: with the "-ssl" option, plug-gw *can* be used as a
one-to-many proxy *provided* the client application uses HTTP and
supports HTTP proxying. Web browsers do that, of course, but also wget,
apt (on Linux Debian), maybe others.

If the client does not so behave, it is relatively easy, starting from
an inetd or xinetd source, to write a relaying application translating
connections to known (I mean in a config file) ports, into connections
to outside host/port, using plug-gw on port 443, which you need anyway
for https.

As a matter of fact, it would be a good thing to have a way of
controlling "plug-gw -ssl": lists of allowed and forbidden destination
hosts/ports, and option to forbid non-ssl sessions. HTTPS support can
hardly be disabled, but once it's there, it is %&#@ easy for internal
users to install tunnels for protocols ranging from nuisance (napster)
through dangerous (IRC with some of these Wintel clients that actually
export every hard or network drive) to malicious (BackOrifice). Anyone
knows of such a patch, or working on one?

Greetings.
-- 
Michel Bardiaux
Peaktime Belgium S.A.  Rue Margot, 37  B-1457 Nil St Vincent
Tel : +32 10 65.44.15  Fax : +32 10 65.44.10