Subject: [fwtk-users] Re: About tn-gw

From: Toshio Kumagai <[email-masked]>
Date: Fri, 30 Nov 2001 00:12:08 +0900

Hi Kiyoshi-san and lists,

	Sorry that what I've said was not true.
	In my understand, tn-gw control is based on source IP address.
	So, ALL incoming telnet connsctions have to be controlled
	under tn-gw and netacl (netacl-telnetd).
	Here are tn-gw section of netperm-table on my firewall.
	Authserver is also working with opie.

*:              authserver 192.168.1.4 AUTHPORT

netacl-telnetd: permit-hosts 127.0.0.1 192.168.1.* 192.168.2.* \
	-exec /usr/sbin/in.telnetd
netacl-telnetd: permit-hosts * -exec /usr/local/etc/tn-gw
tn-gw:          permit-hosts * -auth -xok

	Netacl is called from tcpserver (not inetd...inetd is not
	working on my firewall) like this:

tcpserver -vD -c3 -b5 -t3 0 23 /usr/local/etc/netacl telnetd &

	Hope this helps.

  ###

Toshio Kumagai wrote:
> 
> Hi Kiyoshi-san,
> 
>         What is the role of machine Host-B ?
>         Router ?
>         Or users at Host-A login to Host-B then login to Host C ?
>         Tn-gw would not work if the users log into Host-B first.
>         You have to control the access from Host-A to Host-B
>         in that case.
>         If Host-B acts as a router, then you can control access
>         from Host-A to Host-C in most case.
> 
>   Regards.
> 
>   ###
> 
> Kiyoshi Ohashi wrote:
> >
> > Hello!
> >
> > I want to control access to Host-C from Host-A. Can the tn-gw control access
> > to Host-C from Host-A?
> >
> > (Host-A)--->(tn-gw)--->(Host-B)--->(Host-C)
> >
> > Any hints?
> >
> > Thax!
> >
> > *S*N*O*W***
> >                    Kiyoshi Ohashi
> >                    HITACHI ULSI SYSTEMS CO., LTD.
> >  ' '  _O_/   '     Device Design Center
> >   '  / |  ''
> >  '     - '  '      5-22-1, Josuihon-cho, Kodaira-shi,
> > (~~~~~/ \~~~~) ==  Tokyo, 187-8522 Japan
> >  ~~~~~~~~~~~~      Voice: +81-(0)42-326-1111 ex.3369
> >                    Facimile: +81-(0)42-328-4373
> >                    E-mail: [email-masked]
> >
> > ---
> > You are currently subscribed to fwtk-users as: [email-masked]
> > To unsubscribe send a blank email to [email-masked]
> 
> --
>   Toshio Kumagai        TK2959 / TK127-AP
>                         [email-masked], Japan
> 
> ---
> You are currently subscribed to fwtk-users as: [email-masked]
> To unsubscribe send a blank email to [email-masked]

-- 
  Toshio Kumagai	TK2959 / TK127-AP
			[email-masked], Japan

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]