Subject: plug-gw logs deny=(source host)

From: "Miller, Richard M." <[email-masked]>
Date: Wed, 11 Apr 2001 12:34:38 -0700

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

I'm trying to setup plug-gw to proxy (and I use the term lightly) between
two networks that have no route to each other, but have a route to my
service network (DMZ). These networks are in extranet format and in no way
are connected to the internet.   There are very little routes in either
direction and each host can sucessfully initiate traffice to my plug-gw box.

I've configured the fwtk to use only plug-gw in the following manner:

(netperm-table) 

sna-gw: port sna-print peanut plug-to sna-print-host1 -port sna-print  

where:  sna-print is definded as port 8023 in my services file, and peanut
is the host that i'm testing from., and sna-print-host1 is the destination
of the print jobs ( a FEB running TN3270E for a printer session)

(line from services file)

sna-print       8023/tcp

plug-gw is configured to start from inetd:

(line from inetd.conf)
sna-print stream tcp nowait root /usr/local/etc/plug-gw sna-gw sna-print

When I configure a sna print session with a valid LU and destination, the
stream gets denied by plug-gw.  Keep in mind these networks have free and
clear access to my proxy box, but not each other. This is running on solairs
7 on sun hardware with all the latest patches.  Complied with GNU gcc and
GNU make on a full developer distribution load (on another dev box) and
seems to startup fine.  Netstat shows my box listening on port *.8023 (there
are four IP address's bound to hme0) and I get the following entries in
/var/adm/messages

Apr 10 11:23:17 proxy1 plug-gw[1671]: deny host=peanut/10.223.35.21
service=sna-
print
Apr 10 11:45:44 proxy1 plug-gw[1672]: deny host=peanut/10.223.35.21
service=sna-
print

It's clear to me that plug is denying the connection, even though "peanut"
is explicitly allowed in the netperm table.  scoured the Internet and can't
find any evidence that another service from the fwtk needs to be running.
Could this be the case??

I'm stumped.

This is driving me crazy, if anyone can help me I'd be willing to drive to
you and take you out for lunch if your in No. California...LOL!!

thx in advance.

Richard Miller
Sr. Network Analyst
SF Network Engineering Group 
Banc of America BrokerDealer Services
(formally Montgomery Correspondant Services)
Banc of America Securities, LLC
655 Montgomery Street
San Francisco, Ca. 94111
Phone: 415.913.4223
Cell: 510-517-8555
Fax: 415.913.6542
eMail: [email-masked]

_____________________________________________________________________ 
IMPORTANT NOTICES: 
          This message is intended only for the addressee. Please notify the
sender by e-mail if you are not the intended recipient. If you are not the
intended recipient, you may not copy, disclose, or distribute this message
or its contents to any other person and any such actions may be unlawful.

         Banc of America Securities LLC("BAS") does not accept time
sensitive, action-oriented messages or transaction orders, including orders
to purchase or sell securities, via e-mail.

         BAS reserves the right to monitor and review the content of all
messages sent to or from this e-mail address. Messages sent to or from this
e-mail address may be stored on the BAS e-mail system.

---

From: Rick Murphy <[email-masked]>
Date: Wed, 11 Apr 2001 20:30:50 -0400

>sna-print stream tcp nowait root /usr/local/etc/plug-gw sna-gw sna-print

Change this to
sna-print stream tcp nowait root /usr/local/etc/plug-gw plug-gw sna-gw
Or, start it as a daemon:
/usr/local/etc/plug-gw -daemon sna-print sna-gw
Or, change the netperm-table to be
plug-gw: port sna-print peanut plug-to sna-print-host1 -port sna-print

Why is because plug-gw looks up rules using argv[1]. In your inetd.conf, 
the first argument is "sna-print".
         -Rick