Subject: Re: solaris fwtk question ....

From: [email-masked]
Date: Thu, 2 Aug 2001 12:54:51 +0400

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

-----BEGIN PGP SIGNED MESSAGE-----

Hmm, i'd suggest moving to squid-gw, it seems to be maintained better.
                                     _     _  _  _  _      _  _
 {::} {::} {::}  CU in Hell          _| o |_ | | _|| |   / _||_|   |_ |_ |_
 (##) (##) (##)        /Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|
 [||] [||] [||]            Do i believe in Bible? Hell,man,i've seen one!

---

From: [email-masked] (James Seymour)
Date: Thu, 2 Aug 2001 11:52:21 -0400 (EDT)

> From: Geoff Swavley <[email-masked]>
> 
> Hi All
> 
[snip]
> Alas....
> a quick surf of the net (by me to the offending addresses) while
> bypassing 
> the firewall, did show that the pages loaded correctly when fwtk was
> removed from the equation. 

I'm experiencing something similar with my Gauntlet 4.2 firewall.

> 
> This has started to become an ever increasing scenario (I was willing
> to turn a blind eye to the odd ocurrence) ...
[snip]

Same here.

> 
> It would appear that the errors have something to do with Java code
> being used in the pages loading (comes up with javascript errors on
> status line of netscape browser). 

One of the sites I'm having a problem with uses Java applets, the
other does not.

>                                   The problem is repeatable across
> netscape and Internet explorer via PC's and also via netscape on SUN
> workstations, ...
[snip]

Same here.

> 
> does anyone else suffer from this? Now the big question ..... has a 
> patch been written for http-gw that fixes this?

I posted questions to a couple comp.infosystems.www.* newsgroups, the
Gauntlet mailing list and to the firewall-wizards mailing list.

Nothing came up that led to a solution with http-gw.  Or even any kind
of explanation as to what might be the problem.  One contributor to the
firewall-wizards query suggested:

    "In my experience, these issues have been related to MTU. The
     firewall on your end, or the other end protecting the web site,
     have not been agreeing upon fragmenting packets.

     I would recommend testing this by making your PC (or firewall) set
     a small MTU size, such as 1000 bytes. If it works, then consider
     your options from there."

I tried that.  It "kind of" *seemed* to help on a few of the pages on
one of the sites, but did not solve the problems completely.

I believe I'm going to have to replace http-gw with something else.
Problem is: what can I trust in its place?

I'd simply replace it with a plug proxy except I need to retain the
ability to block ActiveX and, as new Java exploits come up and before
we get the browsers patched, Java.

I'm using T.REX at another site.  Users at that site have no problems
with the web sites in question.  Somebody suggested T.REX uses (a
customized version of?) squid for an http proxy.  Others have suggested
using squid.

I may have to resort to replacing http-gw with squid.

Regards,
Jim
-- 
Jim Seymour                         | Welding Technology Corporation
[email-masked]                  | 24775 Crestview Ct.
Systems, Network & TelCom Admin.    | Farmington Hills, MI. 48335
                                    | FAX: (248)477-8897