Subject: Log Files

From: Jason Smith <[email-masked]>
Date: Wed, 9 May 2001 14:06:01 +0800

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

At the moment I run a FreeBSD machine that acts as a firewall. I use IIS 5.0
as the webserver and i use the plug-gw to pass requests to the webserver.
But in my webservers' log file it says that all requests come from the
firewall (an internal address) how can i make it either send the correct ip
address of the request or log it somewhere within BSD?

---

From: "Larry Moore" <[email-masked]>
Date: Wed, 9 May 2001 16:47:34 +0800

Use IP-Filter within FreeBSD utilising the Redirect feature of the NAT
configuration. You wouls also need to configure the IPF side of things too.

Cheers,

Larry.

---

From: Joseph S D Yao <[email-masked]>
Date: Wed, 9 May 2001 10:30:06 -0400

> address of the request or log it somewhere within BSD?

It's stored in your FWTK logs.  Your IIS is storing the "correct"
address, since all IP transactions to it originate at the firewall, and
all IP transactions from the outside world stop at your firewall.

Having said which, one may hope that you have your IIS in a DMZ, and
sre not making your internal network vulnerable.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
OSIS Center Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: Michel Bardiaux <[email-masked]>
Date: Wed, 09 May 2001 17:03:04 +0200

> all IP transactions from the outside world stop at your firewall.
Those incomplete logs on the web server are IMHO the prime
PITA^H^H^H^Hproblem when using FWTK. Couldn't we have a brain storm on
possible ways to circumvent that?

-- 
Michel Bardiaux
Peaktime Belgium S.A.  Rue Margot, 37  B-1457 Nil St Vincent
Tel : +32 10 65.44.15  Fax : +32 10 65.44.10

---

From: [email-masked]
Date: Wed, 09 May 2001 17:28:34 -0000 (GMT)

> possible ways to circumvent that?

I can't think of any. An application proxy, by its very nature, handles
requests instead of the original source of the request. So, the
incoming IP packets look as if they come from your fwtk host. Unless
you hack some wild 31337 extra tunneled info into a new protocol which
you implement on both sides involved and encapsulate the IP packet and
the info about the original connection. Good luck. 

Then again, you might try and write a little Perl script to extract the
relevant info from your syslog files on the fwtk machine. Might be
easier. 

Bye, Jan

-- 
Radio HUNDERT,6 Medien GmbH Berlin
- EDV -
[email-masked]

---

From: Rick Murphy <[email-masked]>
Date: Wed, 09 May 2001 18:57:31 -0400

>possible ways to circumvent that?

The only simple way to do that has already been mentioned - don't use a 
proxy, use ipfilter rules to redirect the traffic to your web server.

If you're willing to patch your kernel, you can modify the IP stack to 
permit the FWTK system to bind to the original address; that's not what I 
recommend.

Being pragmatic, if you're going to run just a plug-gw in front of your 
webserver, you might as well use ipfilter rules. Plug really doesn't buy 
you much.
         -Rick

---

From: "Luis Fernando Barrera" <[email-masked]>
Date: Wed, 9 May 2001 18:40:17 -0600

There's something not quite clear in this conversation for me...

 If you use ipfilter, you have to enable IP forwarding in the operating
system, right?
    But then why would I need the FWTK? The FWTK is a proxy based firewall,
you wouldn't need
    a packet filter based firewall, right?

Should not be better to use something like http-in? I guess this piece of
software, sends to the webserver a header with
the orignal IP address...

Luis Fernando Barrera
[email-masked]

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On
> Behalf Of Rick Murphy
> Sent: Wednesday, May 09, 2001 16:58
> To: Michel Bardiaux; [email-masked]'
> Subject: Re: Log Files
>
>

---

From: Rick Murphy <[email-masked]>
Date: Wed, 09 May 2001 21:40:41 -0400

At 06:40 PM 5/9/01 -0600, Luis Fernando Barrera wrote:
>you wouldn't need a packet filter based firewall, right?

Yes, but you can deny forwarding for anything other than the packets going 
to the DMZ server, while still using FWTK proxies for other protocols.

>the orignal IP address...

That's one solution, but then the web server logs still report just the 
firewall as the source. You can't use off-the-shelf log analysis tools 
unless you write your own
preprocessor for the logs.
         -Rick

---

From: Michel Bardiaux <[email-masked]>
Date: Thu, 10 May 2001 10:22:31 +0200

> preprocessor for the logs.

Using OS-level tools like ipfilter, ipfwadm, ipchains, or iptables, is
of course the pragmatic solution (and would additionnally do wonders for
performance when you have many connections!). Still, I would like to see
this thread continue a little bit, for 2 reasons:

(1) It requires learning new, *OS-SPECIFIC* (and in the Linux case,
release-specific!) tools - while FWTK is (more or less) a portable
solution.

(2) It looks like an interesting problem in firewall architecture.

To return to the problem of log files, we clearly have to tackle it from
the webserver side. The appropriate question seems to be: can we
convince, say, apache, to query the FW for the real source of the
packets? Eg to cann identd?

---

From: Joseph S D Yao <[email-masked]>
Date: Thu, 10 May 2001 11:33:32 -0400

On Wed, May 09, 2001 at 06:40:17PM -0600, Luis Fernando Barrera wrote:
...
> the orignal IP address...

Yes!

---

From: Tony Gale <[email-masked]>
Date: 11 May 2001 09:09:11 +0100

> packets? Eg to cann identd?

Not that clearly. This can be solved using transparent proxying, I
think.

-tony

---

From: Joseph S D Yao <[email-masked]>
Date: Fri, 11 May 2001 11:01:58 -0400

On Fri, May 11, 2001 at 09:09:11AM +0100, Tony Gale wrote:
...
> Not that clearly. This can be solved using transparent proxying, I

Which is available in Gauntlet but not FWTK, and is not always usable
in one's given situation.

---

From: Tony Gale <[email-masked]>
Date: 11 May 2001 16:09:28 +0100

> in one's given situation.

There's a patch on www.fwtk.org

-tony

---

From: Joseph S D Yao <[email-masked]>
Date: Fri, 11 May 2001 12:30:38 -0400

On Fri, May 11, 2001 at 04:09:28PM +0100, Tony Gale wrote:
...
> There's a patch on www.fwtk.org

Quite right.  Sorry about that.

---

From: "Luis Fernando Barrera" <[email-masked]>
Date: Fri, 11 May 2001 11:26:16 -0600

Hi all,

Anyone has an idea about this message? What could be the source of the
problem? It just
happens sometimes...

May 11 11:00:06 fwtk_server sendmail[1072]: LAA01072: LAB01072: DSN: Too
many hops 27 (25 max): from
<[email-masked]> via localhost, to <[email-masked]>

Luis Fernando Barrera
[email-masked]

PD: The names of the domain have been changed to protect the...

---

From: Rick Murphy <[email-masked]>
Date: Fri, 11 May 2001 13:32:26 -0400

>There's a patch on www.fwtk.org

That requires ipfilter or the equivalent, unfortunately - you're back to 
using packet filtering.
         -Rick

---

From: "Ken Long" <[email-masked]>
Date: Fri, 11 May 2001 12:41:07 -0600

I've received several of these in the recent past as well.  I figured it was 
a routing error somewhere enroute or a problem at the sending end.

I don't think it's anything FWTK could be doing.

Ken Long

---

From: Joseph S D Yao <[email-masked]>
Date: Fri, 11 May 2001 14:52:39 -0400

On Fri, May 11, 2001 at 11:26:16AM -0600, Luis Fernando Barrera wrote:
...
> PD: The names of the domain have been changed to protect the...

For which reason, it is of course more difficult to help you.  But this
will happen when mail arrives at one site, and that site believes that
the mail should be delivered by another site, site 2.  But site 2 in
turn believes that the mail should be delivered by the original site.
So they hand it back and forth until one of them cries quit.

Rarely, more than one site is involved.

---

From: "Luis Fernando Barrera" <[email-masked]>
Date: Fri, 11 May 2001 15:17:31 -0600

That's for sure...

The problem is reported in the FWTK box. It seems the FWTK box is sending
the message to the internal mail server, and then it relays the message back
to FWTK box...

Could it be some configuration problem with the DNS or the Sendmail....?

thanks again.

Luis Fernando Barrera
[email-masked]

> Behalf Of Joseph S D Yao
> Sent: Friday, May 11, 2001 12:53
> To: Luis Fernando Barrera
> Cc: [email-masked]
> Subject: Re: Problem with mail messages
>
>

---

From: Keith Young <[email-masked]>
Date: Fri, 11 May 2001 17:55:48 -0400

> There's a patch on www.fwtk.org

Unless I'm mistaken (which is *entirely* possible due to newborn sleep
deprivation), but doesn't transparent proxying require a route to the
web server? This will be unlikely if the web server is on the inside
net...

If someone is going to write a kernel driver to NAT the proxied address
to the source address (which is how Gauntlet does it, right Rick?), then
I would agree with Rick to use packet filtering instead. Or, you could
come up with a home-grown method of log merging using Perl scripts and a
NTP server.

-- 
--Keith Young
-Director of Customer Care/Support, V-ONE Corp.
[email-masked]

---

From: Joseph S D Yao <[email-masked]>
Date: Fri, 11 May 2001 14:52:39 -0400

---

From: Tony Gale <[email-masked]>
Date: 14 May 2001 10:02:01 +0100

> That requires ipfilter or the equivalent, unfortunately - you're back to 

Only to achieve the redirection, not to perform any packer filtering
function.

-tony