Dotaz: firehol a port forwarding

[mizsu]

Nedari sa mi presmerovat port z FW na PC vo vnutornej sieti.. Ako firewall pouzivam firehol. Config vyzera takto:

version 5

nat to-destination 10.10.0.2 inface eth1 proto "tcp udp" dport 24483

interface eth1 internet src not "${UNROUTABLE_IPS}"
        protection strong 10/sec 10
        server "torrentlisten widehttp openvpn" accept
        client all accept

interface eth0 home
        server all accept
        client all accept

router home2internet inface eth0 outface eth1
        masquerade
        route all accept

"torrentlisten" a "widehttp" su mnou definovane services ktore chcem mat dostupne zvonku.. (80,8080 a 24483) Zaujimavy bude asi len ten torrentlisten, ten je definovany takto:

server_torrentlisten_ports="tcp/24483 udp/24483"
client_torrentlisten_ports="default"

10.10.0.2 je IP PC v LAN na ktory chcem dany port smerovat.. (bittorrent listen port v azureus) v takejto konfiguracii mi ale presmerovanie nefunguje, netusim, na co som mohol zabudnut. Podla vsetkeho co som nasiel na nete by to malo byt ok.. Vie mi niekto poradit? Vdaka :)

Odpovědi

[Sinuhet]

A co je k nalezeni ve /var/log/kern.log?

[mizsu]

tail -f /var/log/kern.log|grep 24483
Jan 21 01:05:14 ztndm3 kernel: PASS-unknown:IN=eth1 OUT=eth0 SRC=82.67.250.38 DST=10.10.0.2 LEN=93 TOS=0x00 PREC=0x20 TTL=112 ID=38979 PROTO=UDP SPT=61318 DPT=24483 LEN=73 
Jan 21 01:05:17 ztndm3 kernel: PASS-unknown:IN=eth1 OUT=eth0 SRC=209.181.105.249 DST=10.10.0.2 LEN=91 TOS=0x00 PREC=0x20 TTL=110 ID=47785 PROTO=UDP SPT=56666 DPT=24483 LEN=71 
Jan 21 01:05:20 ztndm3 kernel: PASS-unknown:IN=eth1 OUT=eth0 SRC=88.16.51.165 DST=10.10.0.2 LEN=93 TOS=0x00 PREC=0x20 TTL=114 ID=39829 PROTO=UDP SPT=10078 DPT=24483 LEN=73 

[Sinuhet]

Ja bych videl problem v tom, ze vy routujete jen spojeni, ktera zacala na vasi lokalni siti. Takze co udela nasledujici konfigurak?

version 5

nat to-destination 10.10.0.2 inface eth1 proto "tcp udp" dport 24483

interface eth1 internet src not "${UNROUTABLE_IPS}"
        protection strong 10/sec 10
	# torrent se routuje na 10.10.0.2, tady byl zbytecne
        server "widehttp openvpn" accept
        client all accept

interface eth0 home
        server all accept
        client all accept

router home2internet inface eth0 outface eth1
        masquerade
        route all accept

router internet2home inface eth1 outface eth0
	route torrentlisten accept

[Sinuhet]

Nebo jeste jednoduseji

version 5

nat to-destination 10.10.0.2 inface eth1 proto "tcp udp" dport 24483

interface eth1 internet src not "${UNROUTABLE_IPS}"
        protection strong 10/sec 10
	# torrent se routuje na 10.10.0.2, tady byl zbytecne
        server "widehttp openvpn" accept
        client all accept

interface eth0 home
        server all accept
        client all accept

router internet2home inface eth1 outface eth0
        masquerade reverse
        client all accept
        server torrentlisten accept

[mizsu]

Diky moc.. Podla vsetkeho mate pravdu, myslim, ze by to takto malo ist. Kazdopadne som v noci len tak so srandy skusal fwbuilder a cez ten sa mi to podarilo v pohodicke naconfovat.. Takze uz je po probleme :) Vdaka za ochotu, mal som problem nieco taketo ohladom firehol-u najst na nete tak teraz uz si to tu snad niekto dalsi najde..