Subject: [fwtk-users] Proxy server plug gateway trouble

From: "Michael V. Plunkett" <[email-masked]>
Date: Wed, 10 Apr 2002 14:32:16 -0400

Hi,
 
I have an application opening a connection to a specific ip address and
port
 but it comes from a specific ip address but the port is random for
every connection.
 
How do I set my firewall up to allow this.
 
It is a fwtk firewall running on a FreeBSD box version 4.2.
We use plug-gateways.
 
Thank You 
MIke

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: Rick Murphy <[email-masked]>
Date: Thu, 11 Apr 2002 08:58:21 -0400

At 02:32 PM 4/10/02 -0400, Michael V. Plunkett wrote:
>-->
>
>Hi,
>
>
>
>I have an application opening a connection to a specific ip address and port
>
>  but it comes from a specific ip address but the port is random for every 
> connection.
>
>
>

Use plug-gw - the plug doesn't care what source port the connection request 
comes from, it only looks at the destination port.
Configure the application to connect to the firewall on the same port, then 
configure the plug-gw to connect onward to the original destination.
         -Rick

---

---

From: "Michael V. Plunkett" <[email-masked]>
Date: Thu, 11 Apr 2002 09:53:19 -0400

Rick,

I was wondering if you see anything wrong with this because it doesn't
work

I have a machine with 2 nic cards one on the 192.168.105 network
and one on the 192.168.139 network.

Now the machine I want to connect from is on the 192.168.50 network 

My fwtk.sh reads as follows

usr/local/libexec/plug-gw -daemon 2460

and my netperm-table

plug gateway:port 2460 192.168.105.* -plug-to 192.168.50.62 -port 2460

We are trying to connect to a Sybase sql server using client software.
Just to see if I have a connection if I telnet from 192.168.50.62 to
192.168.105.110 port 2460 I get a quick connection and then it drops
And the same thing if I telnet from 192.168.105.110 to 192.168.50.62 
port 2460.

But when the client software runs we get a plug denial

Please help
Mike

-----Original Message-----
From: Rick Murphy [mailto:[email-masked]] 
Sent: Thursday, April 11, 2002 7:58 AM
To: fwtk-users
Subject: [fwtk-users] Re: Proxy server plug gateway trouble

port
>  but it comes from a specific ip address but the port is random for
every 
>How do I set my firewall up to allow this.

Use plug-gw - the plug doesn't care what source port the connection
request 
comes from, it only looks at the destination port.
Configure the application to connect to the firewall on the same port,
then 
configure the plug-gw to connect onward to the original destination.
         -Rick

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to
[email-masked]

---

---

From: Rick Murphy <[email-masked]>
Date: Thu, 11 Apr 2002 11:04:54 -0400

>plug gateway:port 2460 192.168.105.* -plug-to 192.168.50.62 -port 2460

that should be

plug-gw: port 2460 ...
along with
plug-gw: permit-hosts 192.168.105.*

If you're using this for Sybase, you might want to look into using the 
sql-gw proxy.
It understands the underlying TNS protocol.
         -Rick

---

---

From: "Michael V. Plunkett" <[email-masked]>
Date: Thu, 11 Apr 2002 12:08:56 -0400

Rick,

I can't seem to find information about the sql-gw proxy.
Is it part of fwtk.

Thanks
Mike

-----Original Message-----
From: Rick Murphy [mailto:[email-masked]] 
Sent: Thursday, April 11, 2002 10:05 AM
To: fwtk-users
Subject: [fwtk-users] Re: Proxy server plug gateway trouble

that should be

plug-gw: port 2460 ...
along with

---

---

---

From: "Michael St. Laurent" <[email-masked]>
Date: Thu, 11 Apr 2002 10:47:40 -0700

I believe it's an add-on or patch.  It's not part of the main distribution.

-- 
Michael St. Laurent
Hartwell Corporation

> From: Michael V. Plunkett [mailto:[email-masked]] 
> Sent: Thursday, April 11, 2002 9:09 AM
> To: fwtk-users
> You are currently subscribed to fwtk-users as: [email-masked]

---

---

From: Keith Young <[email-masked]>
Date: Thu, 11 Apr 2002 13:55:11 -0400

> I believe it's an add-on or patch.  It's not part of the main distribution.

Actually, you want Ark's sybase-gw, which is available at:
	http://www.fwtk.org/fwtk/patches/patches.html#3.16

-- 

-- 
--Keith Young
[email-masked]

---

---

From: Joseph S D Yao <[email-masked]>
Date: Thu, 11 Apr 2002 17:19:06 -0400

> It is a fwtk firewall running on a FreeBSD box version 4.2.

The source port may be random, but surely the destination port must be
the same, or how else would the server know where to listen?

What are the application and the protocol/service involved?

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
OSIS Center Systems Support					EMT-B
-----------------------------------------------------------------------
   This message is not an official statement of OSIS Center policies.

---