Nabble - Endian Firewall

inter-zone rules are not working properly!!

2009-11-23T12:59:00Z

I'm working with efw 2.2 and define some rules for traffics from green to orange and other inter-zones. when I define for example that reject or deny traffic from Green zone to Orange, nothing happens and I can still access to Orange zone!!!
The similar rules are working in outgoing traffic section but no deny or reject rules are working in inter-zone traffic! I have access to zones behind firewall without any limits.

Does anybody know what's the problem with it? Any hints would be helpful.

From forum: efw-user

Can't connect roadwarriors

2009-11-21T05:13:01Z

Hello all!

I have the following setup: Two Endian firewalls are connected through
OpenVPN (Gw2Gw) and everything is working nicely. I can connect
additional roadwarriors to the Endian1 and there is also everything
good. As soon as I try though to connect a roadwarrior to Endian2, the
connection hangs and cannot be completed. For the roadwarrior there isnt
a clear error but I found the following in the Endian2 log:

OpenVPN 2.1_rc7 i586-endian-linux [SSL] [LZO2] [EPOLL] built on Nov 13 2008
local WARNING: file '/var/efw/openvpn/pkcs12.p12' is group or others
accessible
local WARNING: This configuration may accept clients which do not
present a certificate
local Note: Cannot ioctl TUNSETIFF tap1: Device or resource busy (errno=16)
local Note: Attempting fallback to kernel 2.2 TUN/TAP interface
local Cannot open TUN/TAP dev /dev/tap1: No such file or directory
(errno=2)
local Exiting

From what I understand, the problem comes because there is no tap1
device. The tap0 device is probably the one used for the Gw2Gw
connection (client), but, I assume, when I started the OpenVPN server,
the Endian2 box apparently didnt create the second device for the server.

Can anyone help me resolve the problem so I can have roadwarriors
connecting to both boxes?

Thank you very much!
Vassilis

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

From forum: efw-user

Not alerting on ssh login

2009-11-20T12:01:09Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I noticed today that my firewall is not alerting on ssh logins.
Backup emails are working however. What would you guys suggest
checking to see why this isn't working?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.12 (MingW32)
Comment: Use GnuPG with Firefox : http://getfiregpg.org (Version: 0.7.10)

iEYEARECAAYFAksG9YQACgkQ94ZHW4r/A7Kq1wCghKYxVOiVkR04ENV8rqQ5GhBm
t80AoLtIJWOva6DNDLyua0rW+DkfzFWu
=ZQu4
-----END PGP SIGNATURE-----

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

From forum: efw-user

Fwd: Alerting on IPS log

2009-11-20T09:40:22Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I am trying to find a way for my efw 2.3 community edition to send an
email alert based on the snort logs. Does anybody have a tutorial or
some pointers on implementing this?

Thanks

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.12 (MingW32)
Comment: Use GnuPG with Firefox : http://getfiregpg.org (Version: 0.7.10)

iEYEARECAAYFAksG1IYACgkQ94ZHW4r/A7JfEQCfcZA289QbvVIOos7UdZm5KXmc
wFwAn1KXrY134A7n0iJ0/ZHwujk2szKp
=oWWO
-----END PGP SIGNATURE-----

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

signature.asc (368 bytes) Download Attachment

From forum: efw-user

Alerting on IPS log

2009-11-20T09:38:08Z

I am trying to find a way for my efw 2.3 community edition to send an email alert based on the snort logs. Does anybody have a tutorial or some pointers on implementing this?

Thanks

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

signature.asc (278 bytes) Download Attachment

From forum: efw-user

Problema post installazione Endian 2.3

2009-11-20T08:05:10Z

Buongiorno a tutti!
ho appena installato la "efw 2.3", ma ho un problema e non riesco a uscirne:

Ho assegnato alla green interface l'ip 10.10.40.1 e non riesco in alcun modo ad aprire l'interfaccia di amministrazione.

http://10.10.240.1
https://10.10.240.1:10443

La macchina non risponde ai ping e non pinga alcun host nella stessa subnet.
Ho controllato con un "ifconfig" e ho notato che l'ip 10.10.40.1 è assegnato alla interfaccia "br0" mentre alla eth0 non è assegnato alcun indirizzo.

Mi sto perdendo in un bicchier d'acqua?

Buon weekend a tutti.

Umberto "crash_override" Bernardi
Linux Registered User #353811
---------------------------------------------------
Fortis cadere, cedere non potest...

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-italia mailing list
Efw-italia@...
https://lists.sourceforge.net/lists/listinfo/efw-italia

From forum: efw-italia

EFW 2.3 Harware compatibility

2009-11-19T13:16:01Z

Hello,

I'm wondering about the Endian community Firewall 2.3 hardware compatibility... Can't find info about CPU compliance on the Official website.

I'd like to know if I would be able to install Endian 2.3 on this harware :

Hardware manual (pdf)

Specifications :

CPU : Intel ATOM N270
North-Bridge: Intel 82945GSE, MCH- North bridge
South-Bridge: Intel 82801GBM, ICH 7M- South bridge

I saw that Endian was [quote]Endian now supports i386 processors only... Atom is not supported
on that website (see harware support tab) :

http://www.securitywithpassion.com.au/index.php/component/option,com_moofaq/Itemid,143/id,3/view,categories/

Help would be appreciated (I'm planning to buy my hardware soon...)

Thanks

From forum: efw-user

Re: EFW 2.3 content filter settings?

2009-11-19T13:02:09Z

Mike Tremaine wrote:

> I finally playing around with 2.3 in hopes of using it to upgrade the
> old 2.0 install.
>
> First thing I notice is the content filter is not enabled by default
> Then even with you create a access policy that uses the content1 profile
> it doesn't actually do anything.
>
> Second in transparent mode Havp doesn't work at all but in
> non-transparent mode it does.
>
> Maybe I miss something but I'm not really looking forward to spending
> hours debugging this. Anyone have content filtering working in
> transparent mode?
>
> -Mike
>

Argh I figured it out... Green check mark does not mean it is active in
teh content filter it means it is allowed. Red minus means to deny
it.... heavy sigh....

-Mike

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

From forum: efw-user

EFW 2.3 content filter settings?

2009-11-19T12:27:20Z

I finally playing around with 2.3 in hopes of using it to upgrade the
old 2.0 install.

First thing I notice is the content filter is not enabled by default
Then even with you create a access policy that uses the content1 profile
it doesn't actually do anything.

Second in transparent mode Havp doesn't work at all but in
non-transparent mode it does.

Maybe I miss something but I'm not really looking forward to spending
hours debugging this. Anyone have content filtering working in
transparent mode?

-Mike

[If I can get this working to my satisfaction I will build a dev box for
2.3 and push those rpms.]

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

From forum: efw-user

Problems with SMTP proxy and Windows Vista

2009-11-19T01:03:54Z

Hi everybody

We are having problems with a efw 2.2.rc3 installation and SMTP proxy
with Windows Vista and Microsoft Outlook 2007 mail clients. When we
activate SMTP proxy (only Antispam), computers with Vista can't send
emails. They get this error (translated from spanish):

"your server don't admit none of the authentication metods admited by
your client"

I've been watching the logs, and when SMTP proxy is activated, I can see
this lines corresponding to Vista computer:

Nov 19 09:38:07 postfix/smtpd[12311]: disconnect from
unknown[192.168.3.88]
Nov 19 09:38:07 postfix/smtpd[12311]: lost connection after EHLO
from unknown[192.168.3.88]
Nov 19 09:38:07 postfix/smtpd[12311]: connect from unknown[192.168.3.88]
Nov 19 09:37:44 postfix/smtpd[12311]: disconnect from
unknown[192.168.3.88]
Nov 19 09:37:44 postfix/smtpd[12311]: lost connection after EHLO
from unknown[192.168.3.88]
Nov 19 09:37:44 postfix/smtpd[12311]: connect from unknown[192.168.3.88]
Nov 19 09:37:40 postfix/smtpd[12311]: disconnect from
unknown[192.168.3.88]
Nov 19 09:37:40 postfix/smtpd[12311]: lost connection after EHLO
from unknown[192.168.3.88]
Nov 19 09:37:40 postfix/smtpd[12311]: connect from unknown[192.168.3.88]

It seems the proxy is rejecting connections from this computer (and all
Vista computers in the LAN), but XP computers work OK. Obviously, if we
deactivate the SMTP proxy, Vista computers can send emails again.

Does anybody had this problem?

Thanks in advance

Alberto

--

Alberto Iglesias
Gerente
aiglesias@...

-----------------------------------------------------------
ARCANOS INTERCOM S.L.
Centro de Empresas Camargo (local 211)
Polígono Industrial de Trascueto s/n
39600 Revilla de Camargo (Cantabria)

Tel: +34 942 072 801 <http://www.snapanumber.com/>
Tel IP: 700 754 960
Fax: +34 942 072 802 <http://www.snapanumber.com/>
@mail: arcanos@...
Web: http://www.arcanos.es

------------------------------------------------------------------------------------------------------------
Este e-mail y cualquiera de sus ficheros anexos son confidenciales y pueden
incluir información privilegiada. Si usted no es el destinatario adecuado
(o responsable de remitirlo a la persona indicada), agradeceríamos lo
notificase o reenviase inmediatamente al emisor. No revele estos contenidos a
ninguna otra persona, no los utilice para otra finalidad, ni almacene y, o,
copie esta información en medio alguno. Opiniones, conclusiones y otro tipo
de información relacionada con este mensaje que no sean relativas a la
actividad propia de ARCANOS INTERCOM S.L., deberán ser entendidas como
exclusivas del emisor.

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

From forum: efw-user

Re: Confused about port forwarding in Endian 2.3

2009-11-18T18:00:18Z

ok this worked for me in efw2.2 and my main box with slackware running as host/gateway/router. It also worked on my gateway router. lan nic 192.168.1.1
box A efw 2.3
box B 192.168.1.2 web server on port 81

now from box B I open ff or what ever browser put in the www.mydomain.com , and it times out and logs show its being dropped. If I do it with th ipaddress:81 still the same .
This used to work with efw2.2
So unless this is fixed I'll have to go back to 2.2. Makes it horrible for testing too.

It works now for people remote. But still the new rules are way to hard to figure out compared to teh tab that was in 2.2 and previous

> From: compdoc@...
> To: efw-user@...
> Date: Tue, 17 Nov 2009 20:52:20 -0700
> Subject: Re: [Efw-user] Confused about port forwarding in Endian 2.3
>
> Most firewalls don't allow connections to go out then back
> in. You have to tell your computers how to go there
> directly, using its private network address.
>
> If the efw provides your LAN's local dns service, add
> www.host.dyndns.org and its ip address in the host section.
> If some other server provides dns, add a host record there.
>
>
>
>
> -----Original Message-----
> From: Vikash Khatuwala [mailto:vikash@...]
> Sent: Tuesday, November 17, 2009 8:42 PM
> To: efw-user@...
> Subject: Re: [Efw-user] Confused about port forwarding in
> Endian 2.3
>
> Yes I can directly access using the local IP address
> 192.168.1.10
> from GREEN zone, however it does not work when I try with
> the public
> IP address. Also I am using dyndns.org for my dynamic IP
> PPPoE (RED)
> connection.
>
> Outside the network is OK no problem
> http://www.host.dyndns.org:80/ ---(NAT)---> 192.168.1.10:80
> https://www.host.dyndns.org:443/ ---(NAT)--->
> 192.168.1.10:443
>
> From inside the GREEN network (eg. my own PC)
> http://www.host.dyndns.org:80/ --> redirect to
> https://192.168.1.1:10443
> https://www.host.dyndns.org:443/ --> Connection time out.
>
> Thanks,
> Vikash.
>
> At 10:22 AM 18-11-09, compdoc wrote:
> >Can't be opened by name? Can it be opened by its ip
> address?
> >
> >
> >
> >
> >-----Original Message-----
> >From: Vikash Khatuwala [mailto:vikash@...]
> >Sent: Tuesday, November 17, 2009 7:10 PM
> >To: efw-user@...
> >Subject: Re: [Efw-user] Confused about port forwarding in
> >Endian 2.3
> >
> >Hi,
> >
> >Ive been able to get Destination NAT working for my local
> >http
> >server, however when I try to access the website from
> >with-in the
> >GREEN network then it does not work. Any ideas?
> >
> ><ANY>:80 ---(NAT)---> 192.168.1.10:80
> ><ANY>:443 ---(NAT)---> 192.168.1.10:443
> >
> >Vikash.
>
>
> ------------------------------------------------------------
> ------------------
> Let Crystal Reports handle the reporting - Free Crystal
> Reports 2008 30-Day
> trial. Simplify your report design, integration and
> deployment - and focus on
> what you do best, core application coding. Discover what's
> new with
> Crystal Reports now. http://p.sf.net/sfu/bobj-july
> _______________________________________________
> Efw-user mailing list
> Efw-user@...
> https://lists.sourceforge.net/lists/listinfo/efw-user
>
>
> __________ Information from ESET NOD32 Antivirus, version of
> virus signature database 4615 (20091117) __________
>
> The message was checked by ESET NOD32 Antivirus.
>
> http://www.eset.com
>
>
>
> ------------------------------------------------------------------------------
> Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
> trial. Simplify your report design, integration and deployment - and focus on
> what you do best, core application coding. Discover what's new with
> Crystal Reports now. http://p.sf.net/sfu/bobj-july
> _______________________________________________
> Efw-user mailing list
> Efw-user@...
> https://lists.sourceforge.net/lists/listinfo/efw-user

Windows Live: Make it easier for your friends to see what you’re up to on Facebook.
------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

From forum: efw-user

Endian 2.3 / 2Wire (Beginner questions)

2009-11-17T23:07:29Z

Hi:

Please I need some help.

I want to configure the next scenario:

0) Endian 2.3, 2Wire 2701HG-T Gateway
1) LAN 192.168.0.x
2) Endian 2 NICs ( Green 192.168.0.250, Red 192.168.1.250) WMWare
Workstation
3) 2Wire(Internet router) LAN IP 192.168.1.254, default gateway
192.168.1.254 netmask 255.255.255.0)
4) 2Wire(Internet router) WAN IP 189.30.23.12, default gateway
200.38.193.226, DNS1 200.23.242.225, DNS2 200.23.242.209 PPPoE)
5) I need to block all websites, msn, skype for all users
6) I need to have an small user group with privileges for navigate in
specific web pages, msn, skype
7) I need to configure the 6) users throw IPs or MACs
8) Is it possible not to configure anythnig in the user's browser, and just
with the IP/MAC allow 6)
9) GUI config :)

I try to configure this throw GUI but I cannot get this working. Can you
please help?
Thanks in advance.

--
View this message in context: http://old.nabble.com/Endian-2.3----2Wire-%28Beginner-questions%29-tp26402997p26402997.html
Sent from the efw-user mailing list archive at Nabble.com.

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

From forum: efw-user

Re: Confused about port forwarding in Endian 2.3

2009-11-17T20:09:39Z

I have tried to add a host as you suggested however its ignored by
the DNS lookup using 192.168.1.1(EFW local IP) as DNS server in my
PC. It will simply resolve to the public IP.

Ive also check /etc/host.conf and it looks correct "order hosts,bind"

I think this is called loopback NAT which works fine using an off the
shelf BB router such as linksys/dlink/zyxel/etc. Also Ive found some
posts which mention that it used to work in EFW 2.1.x.

http://old.nabble.com/NAT-Loopback-change-in-Endian-Firewall-2.2-td24549413.html

Thanks,
Vikash.

At 11:52 AM 18-11-09, compdoc wrote:
>Most firewalls don't allow connections to go out then back
>in. You have to tell your computers how to go there
>directly, using its private network address.
>
>If the efw provides your LAN's local dns service, add
>www.host.dyndns.org and its ip address in the host section.
>If some other server provides dns, add a host record there.

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

From forum: efw-user

Re: Confused about port forwarding in Endian 2.3

2009-11-17T19:52:20Z

Most firewalls don't allow connections to go out then back
in. You have to tell your computers how to go there
directly, using its private network address.

If the efw provides your LAN's local dns service, add
www.host.dyndns.org and its ip address in the host section.
If some other server provides dns, add a host record there.

-----Original Message-----
From: Vikash Khatuwala [mailto:vikash@...]
Sent: Tuesday, November 17, 2009 8:42 PM
To: efw-user@...
Subject: Re: [Efw-user] Confused about port forwarding in
Endian 2.3

Yes I can directly access using the local IP address
192.168.1.10
from GREEN zone, however it does not work when I try with
the public
IP address. Also I am using dyndns.org for my dynamic IP
PPPoE (RED)
connection.

Outside the network is OK no problem
http://www.host.dyndns.org:80/ ---(NAT)---> 192.168.1.10:80
https://www.host.dyndns.org:443/ ---(NAT)--->
192.168.1.10:443

From inside the GREEN network (eg. my own PC)
http://www.host.dyndns.org:80/ --> redirect to
https://192.168.1.1:10443
https://www.host.dyndns.org:443/ --> Connection time out.

Thanks,
Vikash.

At 10:22 AM 18-11-09, compdoc wrote:
>Can't be opened by name? Can it be opened by its ip
address?

>
>
>
>
>-----Original Message-----
>From: Vikash Khatuwala [mailto:vikash@...]
>Sent: Tuesday, November 17, 2009 7:10 PM
>To: efw-user@...
>Subject: Re: [Efw-user] Confused about port forwarding in
>Endian 2.3
>
>Hi,
>
>Ive been able to get Destination NAT working for my local
>http
>server, however when I try to access the website from
>with-in the
>GREEN network then it does not work. Any ideas?
>
><ANY>:80 ---(NAT)---> 192.168.1.10:80
><ANY>:443 ---(NAT)---> 192.168.1.10:443
>
>Vikash.

------------------------------------------------------------
------------------
Let Crystal Reports handle the reporting - Free Crystal
Reports 2008 30-Day
trial. Simplify your report design, integration and
deployment - and focus on
what you do best, core application coding. Discover what's
new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

__________ Information from ESET NOD32 Antivirus, version of
virus signature database 4615 (20091117) __________

The message was checked by ESET NOD32 Antivirus.

http://www.eset.com

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

From forum: efw-user

Re: Confused about port forwarding in Endian 2.3

2009-11-17T19:42:15Z

Yes I can directly access using the local IP address 192.168.1.10
from GREEN zone, however it does not work when I try with the public
IP address. Also I am using dyndns.org for my dynamic IP PPPoE (RED)
connection.

Outside the network is OK no problem
http://www.host.dyndns.org:80/ ---(NAT)---> 192.168.1.10:80
https://www.host.dyndns.org:443/ ---(NAT)---> 192.168.1.10:443

From inside the GREEN network (eg. my own PC)
http://www.host.dyndns.org:80/ --> redirect to https://192.168.1.1:10443
https://www.host.dyndns.org:443/ --> Connection time out.

Thanks,
Vikash.

At 10:22 AM 18-11-09, compdoc wrote:

>Can't be opened by name? Can it be opened by its ip address?
>
>
>
>
>-----Original Message-----
>From: Vikash Khatuwala [mailto:vikash@...]
>Sent: Tuesday, November 17, 2009 7:10 PM
>To: efw-user@...
>Subject: Re: [Efw-user] Confused about port forwarding in
>Endian 2.3
>
>Hi,
>
>Ive been able to get Destination NAT working for my local
>http
>server, however when I try to access the website from
>with-in the
>GREEN network then it does not work. Any ideas?
>
><ANY>:80 ---(NAT)---> 192.168.1.10:80
><ANY>:443 ---(NAT)---> 192.168.1.10:443
>
>Vikash.

From forum: efw-user

Re: Confused about port forwarding in Endian 2.3

2009-11-17T18:22:30Z

Can't be opened by name? Can it be opened by its ip address?

-----Original Message-----
From: Vikash Khatuwala [mailto:vikash@...]
Sent: Tuesday, November 17, 2009 7:10 PM
To: efw-user@...
Subject: Re: [Efw-user] Confused about port forwarding in
Endian 2.3

Hi,

Ive been able to get Destination NAT working for my local
http
server, however when I try to access the website from
with-in the
GREEN network then it does not work. Any ideas?

<ANY>:80 ---(NAT)---> 192.168.1.10:80
<ANY>:443 ---(NAT)---> 192.168.1.10:443

Vikash.

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

From forum: efw-user

Re: Confused about port forwarding in Endian 2.3

2009-11-17T18:09:38Z

Hi,

Ive been able to get Destination NAT working for my local http
server, however when I try to access the website from with-in the
GREEN network then it does not work. Any ideas?

<ANY>:80 ---(NAT)---> 192.168.1.10:80
<ANY>:443 ---(NAT)---> 192.168.1.10:443

Vikash.

At 05:59 AM 18-11-09, Zola wrote:

>Hi!
>
>its dosen't matter where use.
>
>Some simple example:
>
>DNAT:
>incoming connection from internet to PUBLIC IP address http port.
>(your http server in your network with PRIVATE ip address)
>Connection: 195.x.x.x(client from internet,source) to
>PUBLICIP(destination) TCP 80
>
>rule: Source(ALL client in the world) Target(your UPLINK or RED)
>Service/Port TCP/80 Translate to 192.168.1.2(youe PRIVATE webserver)
>
>after "translation" looks like this:
>195.x.x.x(client from internet,source) to 192.168.1.2(destination) TCP 80
>
>You see DNAT translate destination address.
>
>
>SNAT:
>example(last time i set similar rule..) you have Special VPN router in
>DMZ, the default GW not endian, the device forward all packages to GW
>when try to reach 192.168.0.x network. the device only known
>172.16.0.x is a LAN.
>GREEN: 192.168.0.x
>ORANGE: 172.16.0.x endianip: 172.16.0.1
>
>You try to connect your client
>Connection: 192.168.0.2(source) to 172.16.0.2(VPNrouter,destination)
>http port.
>You cant connect, because 172.16.0.2 sent packages to 192.168.0.2 via
>own other gateway.
>
>rule: Source(192.168.0.2 or GREEN) Destination(172.16.0.2)
>Service/Port TCP/80 Translate to 172.16.0.1(your endian IP)
>
>after "translation" looks like this:
>172.16.0.1(source) to 172.16.0.2(destination) TCP 80
>
>Now, VPNrouter able to sent back packeges ( endian translate ip back
>to original source) and you receive on your client.
>
>
>i hope that helps.
>
>
>Zola
>
>
>2009/11/16 jonas kellens <jonas.kellens@...>:
> > http://docs.endian.com/firewall.html
> >
> > This the documentation, but I must say it is very brief !
> >
> > Still don't know if I need Destination NAT or Source NAT. Both are offering
> > the NATting of a public IP-address to a private IP-address.
> >
> > If I'm running a webserver, Source NAT will offer me the ability to
> > portforward incoming traffic on my public IP-address to the private address
> > of the webserver.
> > The documentation even states "Adding Source NAT rules is similar to adding
> > port forwarding rules"
> >
> > In my opinion Destination NAT goes a little bit further. The documentation
> > states :
> > "It is possible to define which port on which interface should be forwarded
> > to a given host and port".
> >
> > So here I can even implement a port-forwarding rule from the GREEN network
> > to the ORANGE network. So if I state that port 80 needs to be forwarded to
> > the webserver on the ORANGE network I will be unable to browse websites on
> > the public Internet.
> >
> > So am I right that Source NAT is port forwarding from RED to
> GREEN or ORANGE
> > ??
> > And am I right that Destination NAT is port forwarding from whichever
> > network to whichever network ?? (GREEN to GREEN, GREEN to ORANGE, GREEN to
> > RED, ORANGE to GREEN,...)
> >
> > Really need some clarification here !!
> >
> > Jonas.
> >
> > On Thu, 2009-11-12 at 21:30 +0000, oneforall immortal wrote:
> >
> > Hi
> > I have the same problem too with this weird split tabs .
> > I'm just about to give up and use 2.2 again since it made more sense
> > I'm trying to get incoming port 587 to redirect to my mail box on the
> > lan(green) but I see in the /var/log/messages it is getting INPUT:DROP
> > But I have <ANY Uplink>(tried Uplink main [RED]) 192,168,1,2 Allow with
> > ips(tried ALLOW)
> > User defined TCP 587 Translate to ip nat 192.168.1.2 port 587
> > It was so much easier the old way . I even tried the incomimng ,which I
> > thought should be it since its an incomimg port I want to redirect. But
> > neither allows you to say what the incoming port is . I don't think we
> > really want it to be any . I also can't tell the diff with Destination NAT
> > and Incoming routed traffic. The names are a bit misleading .
> > The help also isn't working :
> > Not Found
> > The requested URL /2.3/en/firewall.html was not found on this server.
> > Apache/2.0.52 (CentOS) Server at docs.endian.com Port 80
> > Some new things look really good. But I need my incoming email to work :)
> > Also this eamil system is so darn complicated to use. I can't
> figure out how
> > to add coments or add a new bug etc.
> > So far because i got your email I'm trying to use this to hopefully get
> > answers and see it added to yours to confirm it.
> > But even the email didn't have a link to yours . It took me a whiel to
> > figure it out where to go O.o
> > I thought kde mail was bad .:)
> >
> >
> >
> ------------------------------------------------------------------------------
> > Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
> > trial. Simplify your report design, integration and deployment - and focus
> > on
> > what you do best, core application coding. Discover what's new with
> > Crystal Reports now. http://p.sf.net/sfu/bobj-july
> > _______________________________________________
> > Efw-user mailing list
> > Efw-user@...
> > https://lists.sourceforge.net/lists/listinfo/efw-user
> >
> >
>
>------------------------------------------------------------------------------
>Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
>trial. Simplify your report design, integration and deployment - and focus on
>what you do best, core application coding. Discover what's new with
>Crystal Reports now. http://p.sf.net/sfu/bobj-july
>_______________________________________________
>Efw-user mailing list
>Efw-user@...
>https://lists.sourceforge.net/lists/listinfo/efw-user

From forum: efw-user

Re: Confused about port forwarding in Endian 2.3

2009-11-17T13:59:27Z

Hi!

its dosen't matter where use.

Some simple example:

DNAT:
incoming connection from internet to PUBLIC IP address http port.
(your http server in your network with PRIVATE ip address)
Connection: 195.x.x.x(client from internet,source) to
PUBLICIP(destination) TCP 80

rule: Source(ALL client in the world) Target(your UPLINK or RED)
Service/Port TCP/80 Translate to 192.168.1.2(youe PRIVATE webserver)

after "translation" looks like this:
195.x.x.x(client from internet,source) to 192.168.1.2(destination) TCP 80

You see DNAT translate destination address.

SNAT:
example(last time i set similar rule..) you have Special VPN router in
DMZ, the default GW not endian, the device forward all packages to GW
when try to reach 192.168.0.x network. the device only known
172.16.0.x is a LAN.
GREEN: 192.168.0.x
ORANGE: 172.16.0.x endianip: 172.16.0.1

You try to connect your client
Connection: 192.168.0.2(source) to 172.16.0.2(VPNrouter,destination) http port.
You cant connect, because 172.16.0.2 sent packages to 192.168.0.2 via
own other gateway.

rule: Source(192.168.0.2 or GREEN) Destination(172.16.0.2)
Service/Port TCP/80 Translate to 172.16.0.1(your endian IP)

after "translation" looks like this:
172.16.0.1(source) to 172.16.0.2(destination) TCP 80

Now, VPNrouter able to sent back packeges ( endian translate ip back
to original source) and you receive on your client.

i hope that helps.

Zola

2009/11/16 jonas kellens <jonas.kellens@...>:

> http://docs.endian.com/firewall.html
>
> This the documentation, but I must say it is very brief !
>
> Still don't know if I need Destination NAT or Source NAT. Both are offering
> the NATting of a public IP-address to a private IP-address.
>
> If I'm running a webserver, Source NAT will offer me the ability to
> portforward incoming traffic on my public IP-address to the private address
> of the webserver.
> The documentation even states "Adding Source NAT rules is similar to adding
> port forwarding rules"
>
> In my opinion Destination NAT goes a little bit further. The documentation
> states :
> "It is possible to define which port on which interface should be forwarded
> to a given host and port".
>
> So here I can even implement a port-forwarding rule from the GREEN network
> to the ORANGE network. So if I state that port 80 needs to be forwarded to
> the webserver on the ORANGE network I will be unable to browse websites on
> the public Internet.
>
> So am I right that Source NAT is port forwarding from RED to GREEN or ORANGE
> ??
> And am I right that Destination NAT is port forwarding from whichever
> network to whichever network ?? (GREEN to GREEN, GREEN to ORANGE, GREEN to
> RED, ORANGE to GREEN,...)
>
> Really need some clarification here !!
>
> Jonas.
>
> On Thu, 2009-11-12 at 21:30 +0000, oneforall immortal wrote:
>
> Hi
> I have the same problem too with this weird split tabs .
> I'm just about to give up and use 2.2 again since it made more sense
> I'm trying to get incoming port 587 to redirect to my mail box on the
> lan(green) but I see in the /var/log/messages it is getting INPUT:DROP
> But I have <ANY Uplink>(tried Uplink main [RED]) 192,168,1,2 Allow with
> ips(tried ALLOW)
> User defined TCP 587 Translate to ip nat 192.168.1.2 port 587
> It was so much easier the old way . I even tried the incomimng ,which I
> thought should be it since its an incomimg port I want to redirect. But
> neither allows you to say what the incoming port is . I don't think we
> really want it to be any . I also can't tell the diff with Destination NAT
> and Incoming routed traffic. The names are a bit misleading .
> The help also isn't working :
> Not Found
> The requested URL /2.3/en/firewall.html was not found on this server.
> Apache/2.0.52 (CentOS) Server at docs.endian.com Port 80
> Some new things look really good. But I need my incoming email to work :)
> Also this eamil system is so darn complicated to use. I can't figure out how
> to add coments or add a new bug etc.
> So far because i got your email I'm trying to use this to hopefully get
> answers and see it added to yours to confirm it.
> But even the email didn't have a link to yours . It took me a whiel to
> figure it out where to go O.o
> I thought kde mail was bad .:)
>
>
> ------------------------------------------------------------------------------
> Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
> trial. Simplify your report design, integration and deployment - and focus
> on
> what you do best, core application coding. Discover what's new with
> Crystal Reports now. http://p.sf.net/sfu/bobj-july
> _______________________________________________
> Efw-user mailing list
> Efw-user@...
> https://lists.sourceforge.net/lists/listinfo/efw-user
>
>

From forum: efw-user

Re: Confused about port forwarding in Endian 2.3

2009-11-17T02:52:48Z

Ill give some little bit trick explanation .it can be use if u re using earlier version 2.2 and u want to get some backup config backup from this.After that get this file and open it widows note pad and edit u re config file which u want

Thanks
Rajeewa

--- On Mon, 16/11/09, jonas kellens <jonas.kellens@...> wrote:

> From: jonas kellens <jonas.kellens@...>
> Subject: Re: [Efw-user] Confused about port forwarding in Endian 2.3
> To: efw-user@...
> Date: Monday, 16 November, 2009, 10:59
>
>
>
>
>
>
>
> http://docs.endian.com/firewall.html
>
>
>
> This the documentation, but I must say it is very brief !
>
>
>
> Still don't know if I need Destination NAT or Source
> NAT. Both are offering the NATting of a public IP-address to
> a private IP-address.
>
>
>
> If I'm running a webserver, Source NAT will offer me
> the ability to portforward incoming traffic on my public
> IP-address to the private address of the webserver.
>
> The documentation even states "Adding Source NAT
> rules is similar to adding port forwarding rules"
>
>
>
> In my opinion Destination NAT goes a little bit further.
> The documentation states :
>
> "It is possible to define which port on which
> interface should be forwarded to a given host and
> port".
>
>
>
> So here I can even implement a port-forwarding rule from
> the GREEN network to the ORANGE network. So if I state that
> port 80 needs to be forwarded to the webserver on the ORANGE
> network I will be unable to browse websites on the public
> Internet.
>
>
>
> So am I right that Source NAT is port forwarding from RED
> to GREEN or ORANGE ??
>
> And am I right that Destination NAT is port forwarding from
> whichever network to whichever network ?? (GREEN to GREEN,
> GREEN to ORANGE, GREEN to RED, ORANGE to GREEN,...)
>
>
>
> Really need some clarification here !!
>
>
>
> Jonas.
>
>
>
> On Thu, 2009-11-12 at 21:30 +0000, oneforall immortal
> wrote:
>
>
> Hi
>
> I have the same problem too with this weird split
> tabs .
>
> I'm just about to give up and use 2.2 again since
> it made more sense
>
> I'm trying to get incoming port 587 to redirect to
> my mail box on the lan(green) but I see in the
> /var/log/messages it is getting INPUT:DROP
>
> But I have <ANY Uplink>(tried Uplink main
> [RED]) 192,168,1,2 Allow with ips(tried ALLOW)
>
> User defined TCP 587 Translate to ip nat
> 192.168.1.2 port 587
>
> It was so much easier the old way . I even tried the
> incomimng ,which I thought should be it since its an
> incomimg port I want to redirect. But neither allows you to
> say what the incoming port is . I don't think we really
> want it to be any . I also can't tell the diff with
> Destination NAT and Incoming routed traffic. The names
> are a bit misleading .
>
> The help also isn't working :
>
> Not Found
>
> The requested URL /2.3/en/firewall.html was not found
> on this server.
>
> Apache/2.0.52 (CentOS) Server at docs.endian.com Port
> 80
>
> Some new things look really good. But I need my
> incoming email to work :)
>
> Also this eamil system is so darn complicated to use. I
> can't figure out how to add coments or add a new bug
> etc.
>
> So far because i got your email I'm trying to use
> this to hopefully get answers and see it added to yours to
> confirm it.
>
> But even the email didn't have a link to yours . It
> took me a whiel to figure it out where to go O.o
>
> I thought kde mail was bad .:)
>
>
>
>
>
>
>
> -----Inline Attachment Follows-----
>
> ------------------------------------------------------------------------------
> Let Crystal Reports handle the reporting - Free Crystal
> Reports 2008 30-Day
> trial. Simplify your report design, integration and
> deployment - and focus on
> what you do best, core application coding. Discover what's
> new with
> Crystal Reports now. http://p.sf.net/sfu/bobj-july
> -----Inline Attachment Follows-----
>
> _______________________________________________
> Efw-user mailing list
> Efw-user@...
> https://lists.sourceforge.net/lists/listinfo/efw-user
>

From forum: efw-user

EFW 2.3 Destination NAT with loopback from GREEN

2009-11-16T05:25:38Z

Hello,

Interfaces : 2 - GREEN and RED (PPPoE)
WAN (RED) : Dynamic IP PPPoE
LAN (GREEN) : 192.168.1.0/24

Local server on GREEN interface IP : 192.168.1.10
Services to be forwarded WAN2LAN : HTTP, HTTPS, SSH, FTP

Dynamic DNS with wildcard www.host.dyndns.org -> Uplink main IP (RED).

At the moment Im testing with a Destination NAT to forward HTTP and
HTTPS from external IP to my local server on the same port.

<ANY>:80 ---(NAT)---> 192.168.1.10:80
<ANY>:443 ---(NAT)---> 192.168.1.10:443

This works fine externally, ie. www.host.dyndns.org will correctly
NAT forward to 192.168.1.10:80 however I cannot access it using the
same URL from inside the GREEN network (ie. my PC on the GREEN
network). Ive looked around on the Internet and could not find a
solution. A DNS solution is not preferred and will not be workable
for me since Im using dynamic DNS. Ive tested on both EFW 2.2 and 2.3.

This is simply a loopback NAT from the local network which works fine
using an off the shelf BB router such as linksys/dlink/etc. Ive found
some posts which mention that it used to work in EFW 2.1.x.

Any help will be appreciated.

Thanks,
Vikash Khatuwala.

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

From forum: efw-user

Re: Confused about port forwarding in Endian 2.3

2009-11-16T02:59:53Z

http://docs.endian.com/firewall.html

This the documentation, but I must say it is very brief !

Still don't know if I need Destination NAT or Source NAT. Both are offering the NATting of a public IP-address to a private IP-address.

If I'm running a webserver, Source NAT will offer me the ability to portforward incoming traffic on my public IP-address to the private address of the webserver.
The documentation even states "Adding Source NAT rules is similar to adding port forwarding rules"

In my opinion Destination NAT goes a little bit further. The documentation states :
"It is possible to define which port on which interface should be forwarded to a given host and port".

So here I can even implement a port-forwarding rule from the GREEN network to the ORANGE network. So if I state that port 80 needs to be forwarded to the webserver on the ORANGE network I will be unable to browse websites on the public Internet.

So am I right that Source NAT is port forwarding from RED to GREEN or ORANGE ??
And am I right that Destination NAT is port forwarding from whichever network to whichever network ?? (GREEN to GREEN, GREEN to ORANGE, GREEN to RED, ORANGE to GREEN,...)

Really need some clarification here !!

Jonas.

On Thu, 2009-11-12 at 21:30 +0000, oneforall immortal wrote:

Hi
I have the same problem too with this weird split tabs .
I'm just about to give up and use 2.2 again since it made more sense
I'm trying to get incoming port 587 to redirect to my mail box on the lan(green) but I see in the /var/log/messages it is getting INPUT:DROP
But I have <ANY Uplink>(tried Uplink main [RED]) 192,168,1,2 Allow with ips(tried ALLOW)
User defined TCP 587 Translate to ip nat 192.168.1.2 port 587
It was so much easier the old way . I even tried the incomimng ,which I thought should be it since its an incomimg port I want to redirect. But neither allows you to say what the incoming port is . I don't think we really want it to be any . I also can't tell the diff with Destination NAT and Incoming routed traffic. The names are a bit misleading .
The help also isn't working :
Not Found
The requested URL /2.3/en/firewall.html was not found on this server.
Apache/2.0.52 (CentOS) Server at docs.endian.com Port 80
Some new things look really good. But I need my incoming email to work :)
Also this eamil system is so darn complicated to use. I can't figure out how to add coments or add a new bug etc.
So far because i got your email I'm trying to use this to hopefully get answers and see it added to yours to confirm it.
But even the email didn't have a link to yours . It took me a whiel to figure it out where to go O.o
I thought kde mail was bad .:)

From forum: efw-user

SIP proxy not working

2009-11-16T01:39:41Z

Hi All,
I have installed and prepared one system for Endian gateway,
I have added two network cards in that.
System configuration is given below
CPU: Intel P4 3.00 GHz
RAM: 1 GB
HDD: 80 GB
LAN CARDS: 2 (One is on board and other is D-LINK connected on other port)
I am trying to keep SIP proxy configuration on endian gateway webpage,
But when i am saving it, it said saved and when i am opening that link the data is lost,
I think this is bug of system, it is not saving the data on sip proxy,

please let me know how we can update the system,

Please help me if any one has ideas,

Thanks,
Max Alex
Voip Developer

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

From forum: efw-user

Re: EFW in Xen-DomU: network interfaces missing after changing mainboard and CPU

2009-11-15T23:40:26Z

Hi Neobiker!

On Sat, 14 Nov 2009, Neobiker wrote:

> you can try this, maybe it helps:
> http://www.ctserver.org/fpost18412.html#18412
>
> Edit File /etc/businfotab and try ethconfig -a
>
> root@efw23rc1:~ # cat /etc/businfotab
> # Generated by ethconfig
> eth0 XEN-eth0
> eth1 XEN-eth1

On my system, it looks like this:

,---- [ /etc/businfotab ]
| # Generated by ethconfig
| eth0 00:00.0
| eth1 00:01.0
| eth2 00:02.0
| eth3 00:03.0
`----

I'm pretty sure that the PCI-IDs didn't change, since they are generated
by Xen (they look different on the host system). And I also tried
"Restore to factory defaults", that didn't help either.

Anyway: my Dom0 still was Debian Etch (Xen 3.0.2). I updated to Debian
Lenny (Xen 3.2) because I wanted to reinstall the complete Xen setup,
including the virtual machines. My new CPU supports Vanderpool, so I
thought I should be able to run a DomU without a modified kernel. Just
for fun, I started the Endian DomU after the upgrade, and... it worked!

I have no idea why (and that really bugs me), but it's working again.
Before my update, a fresh setup Debian DomU was working, too. So the
Dom0-setup wasn't broken, either. At least not completely...

Whatever: thanks for your help!

Ciao,
Ronald.

--
Ronald Schaten :: http://www.schatenseite.de
--
Write a wise saying and your name will live forever.
(Anonymous)

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

From forum: efw-user

Multiple RED interface support

2009-11-15T23:28:28Z

Hi,
We have installed successfully Endian Firewall on our system.
System configuration is given below
CPU: Intel P4 3.00 GHz
RAM: 1 GB
HDD: 80 GB
LAN CARDS: 2 (One is on board and other is D-LINK connected on other port)

We want to add one more LAN card in this system, so it will be three lan cards,
We have two WAN internet connections for RED interfaces,
Both WAN connections are with 1 MBPS broadband connection,
Our requirement is that we need to combine both the RED interfaces so we can get 2MBPS connections in our network,
So, Is there any way to use both the RED interface with the configuration in endian and we will get 2 MBPS as output on our network,

Really need help for this!!
Waiting for reply.

Thanks in advance!!
MAX

Thanks,
Max Alex
Voip Developer

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

From forum: efw-user

Re: EFW in Xen-DomU: network interfaces missing after changing mainboard and CPU

2009-11-14T09:24:08Z

Hi Ronald,

you can try this, maybe it helps: http://www.ctserver.org/fpost18412.html#18412

Edit File /etc/businfotab and try ethconfig -a

root@efw23rc1:~ # cat /etc/businfotab
# Generated by ethconfig
eth0 XEN-eth0
eth1 XEN-eth1

regards
neobiker

From forum: efw-user

OpenVPN 2.3.0 Firewall rules

2009-11-13T17:26:28Z

Hi
I have switched from efw 2.2 to 2.3 (no upgrade - complete new installation and reconfiguration) everything is running smoothly again but I can't get the OpenVPN running correctly. I'm able to connect but not able to ping the efw host it self nor any other host in the blue or green network.

RED: 192.168.2.6/24
GREEN: 10.1.1.26/24
BLUE: 192.168.0.1/24
OpenVPN DHCP-Pool: 10.1.1.201-250

VPN-Firewall:
Source: GREEN+OPENVPN
Destination:GREEN + OPENVPN + BLUE
Service: ALL
Rule: ALLOW + IPS
Name: Test

Do I have to allow green to green in the inter zone Firewall?

Greetings from Duesseldorf
Daniel

--
Daniel Dietz
Franca Trading GmbH
Klosterstr. 49
40211 Düsseldorf
M +49 (0) 175-4212176

AG Düsseldorf HRB 53452
USt-ID: DE813955073
Geschäftsführer: Patrick Seidel

Diese E-Mail sowie eventuelle Anhänge enthalten vertrauliche und / oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren oder Speichern sowie die unbefugte Weitergabe dieser E-Mail sind nicht gestattet.

This e-mail and any attachments may contain confidential and / or privileged information. If you are not the intended recipient or have received this e-mail in error, please notify the sender immediately and destroy this e-mail . Any unauthorized copying, storing, disclosure or distribution of the contents of this e-mail is strictly forbidden.

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

From forum: efw-user

Re: Confused about port forwarding in Endian 2.3

2009-11-12T13:30:34Z

Hi
I have the same problem too with this weird split tabs .
I'm just about to give up and use 2.2 again since it made more sense
I'm trying to get incoming port 587 to redirect to my mail box on the lan(green) but I see in the /var/log/messages it is getting INPUT:DROP
But I have <ANY Uplink>(tried Uplink main [RED]) 192,168,1,2 Allow with ips(tried ALLOW)
User defined TCP 587 Translate to ip nat 192.168.1.2 port 587
It was so much easier the old way . I even tried the incomimng ,which I thought should be it since its an incomimg port I want to redirect. But neither allows you to say what the incoming port is . I don't think we really want it to be any . I also can't tell the diff with Destination NAT and Incoming routed traffic. The names are a bit misleading .
The help also isn't working :
Not Found
The requested URL /2.3/en/firewall.html was not found on this server.
Apache/2.0.52 (CentOS) Server at docs.endian.com Port 80
Some new things look really good. But I need my incoming email to work :)
Also this eamil system is so darn complicated to use. I can't figure out how to add coments or add a new bug etc.
So far because i got your email I'm trying to use this to hopefully get answers and see it added to yours to confirm it.
But even the email didn't have a link to yours . It took me a whiel to figure it out where to go O.o
I thought kde mail was bad .:)

From: jonas.kellens@...
To: efw-user@...
Date: Thu, 12 Nov 2009 21:30:58 +0100
Subject: [Efw-user] Confused about port forwarding in Endian 2.3

Hello list,

Can someone point me to the documentation about port forwarding/NAT ??

I am very confused about the several fields that need to be filled in.

What is the meaning of "Access from" "target" and "translate to" ??

Wouldn't it be easier with an incoming interface (like red) and a incoming port (like 10080) and destination IP (like 192.168.1.2) en destination port (like 80).

I have configured a portforwarding rule but it is not working :

Access from : Uplink main (red)
(what is the meaning of all those other interfaces listed ???)
Target : 192.168.1.2
Filter policy : allow
Service/port : user defined, TCP, 10080
Translate to : IP ; NAT ; insert IP : 192.168.1.2 Port : 80

Can you please explain me how to correctly configure port forwarding, because the above configuration is not working ?!

Using Endian 2.3. (Port forwarding was a whole lot easier in version 2.2)

Thanks in advance,

Jonas.

Get a great deal on Windows 7 and see how it works the way you want. Check out the offers on Windows 7now.
------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

From forum: efw-user

Confused about port forwarding in Endian 2.3

2009-11-12T12:30:58Z

Hello list,

Can someone point me to the documentation about port forwarding/NAT ??

I am very confused about the several fields that need to be filled in.

What is the meaning of "Access from" "target" and "translate to" ??

Wouldn't it be easier with an incoming interface (like red) and a incoming port (like 10080) and destination IP (like 192.168.1.2) en destination port (like 80).

I have configured a portforwarding rule but it is not working :

Access from : Uplink main (red)
(what is the meaning of all those other interfaces listed ???)
Target : 192.168.1.2
Filter policy : allow
Service/port : user defined, TCP, 10080
Translate to : IP ; NAT ; insert IP : 192.168.1.2 Port : 80

Can you please explain me how to correctly configure port forwarding, because the above configuration is not working ?!

Using Endian 2.3. (Port forwarding was a whole lot easier in version 2.2)

Thanks in advance,

Jonas.
------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

From forum: efw-user

EFW in Xen-DomU: network interfaces missing after changing mainboard and CPU

2009-11-12T10:19:52Z

Hello everybody...

I already asked this on efwsupport.com, but maybe this list is the
better way. Don't worry about this kind of cross-posting, if you have a
solution for me I'll post it to the forum and vice-versa. So everyone
profits. ;-)

I ran EFW for more than a year as a virtual machine under Xen (DomU).
There's a PCI quad-NIC in the system that is hidden from Dom0 and given
directly to the EFW-DomU.

Everything was fine until last weekend I changed the mainboard and CPU
in the computer. The quad-NIC has new IRQs now, and the PCI address
changed. I reconfigured my kernel boot line, and the configuration of
the Endian-DomU.

Now, with lspci I can see that there is the card visible for the Endian:

00:00.0 Ethernet controller: Digital Equipment Corporation DECchip 21140
[FasterNet] (rev 22)
00:01.0 Ethernet controller: Digital Equipment Corporation DECchip 21140
[FasterNet] (rev 22)
00:02.0 Ethernet controller: Digital Equipment Corporation DECchip 21140
[FasterNet] (rev 22)
00:03.0 Ethernet controller: Digital Equipment Corporation DECchip 21140
[FasterNet] (rev 22)

The driver (tulip) loads without error messages, in dmesg output I see:

Linux Tulip driver version 1.1.13 (May 11, 2002)
PCI: Enabling device 0000:00:00.0 (0000 -> 0003)
PCI: Enabling device 0000:00:01.0 (0000 -> 0003)
PCI: Enabling device 0000:00:02.0 (0000 -> 0003)
PCI: Enabling device 0000:00:03.0 (0000 -> 0003)

There was more output when the card still did work, but I don't have it
anymore. This is the similar output from my plain Debian test system:

Linux Tulip driver version 1.1.13-NAPI (May 11, 2002)
PCI: Enabling device 0000:00:00.0 (0000 -> 0003)
tulip0: EEPROM default media type Autosense.
tulip0: Index #0 - Media MII (#11) described by a 21140 MII PHY (1)
block.
tulip0: MII transceiver #1 config 3100 status 7849 advertising 0101.
eth0: Digital DS21140 Tulip rev 34 at 0001ec00, 00:00:D1:1D:43:EF, IRQ
21.
PCI: Enabling device 0000:00:01.0 (0000 -> 0003)
[...]

But on EFW, ifconfig doesn't show the interfaces (eth0 to eth3) anymore.

I tried giving the card to another virtual machine (plain Debian), and
there I can use the NIC without any problems. So I think there's
everything fine with the hardware and the host system. Somehow, Endian
did recognize the change in hardware and doesn't accept it.

What can I do?

Thanks in advance!

Ciao,
Ronald.

--
Ronald Schaten :: http://www.schatenseite.de
--
Larkinson's Law: All laws are basically false.

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

From forum: efw-user

Re: VMWare Tools for EFW 2.3?

2009-11-12T00:10:51Z

Elmar Natter <en@...> writes:

>
>
> I'm using EFW 2.3 in a ESXi Enviroement. Performance is just
> great but I still miss the VMWare Tools to have the heartbeat and
> shutdown feature. Has somebody compiled the vmware tools and is
> able to provide them?
>
> Would be great!
>
> Elmar
>
> ------------------------------------------------------------------------------
> Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
> trial. Simplify your report design, integration and deployment - and focus on
> what you do best, core application coding. Discover what's new with
> Crystal Reports now. http://p.sf.net/sfu/bobj-july
>

Hello,

I also would like to have vmware tools inside Endian firewall.
I find this how to's:

for Efw 2.1.1
http://www.rndgroup.co.nz/blog/2009/01/30/vmware-tools-in-an-endian-appliance/

for Efw 2.2RC3
http://www.howtoforge.com/install-vmware-tools-on-endian-firewall-community-2.2-rc3-on-esxi-3.5

But actually it looks like, inside the Efw 2.3-developper package are a lot of
necessary files missing.
( see also http://bugs.endian.it/view.php?id=2302 )

Otherwise it should be not to difficult to write a small script, that everybody
who likes to, can install the vmware tools easy.

Does anybody know, from where I can load the missing files ?

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

From forum: efw-user

Added new routing table to Endian

2009-11-11T21:39:01Z

Hi all,

I am trying to setup an alternative routing table to be used in specific
circumstances. I do the following

1) Use iptables to mark the relevant packets

iptables -t mangle -I POLICYROUTING 1 -p tcp --dport 80 -j CONNMARK
--set-mark 2024/0x7F8
iptables -t mangle -I POLICYROUTING 2 -p tcp --dport 80 -m connmark !
set-mark 0/0x7F8 -j RETURN

2) Edited /etc/iproute2/rt_tables and added 250 loadbalance

3) Ran "ip route add default table loadbalance scope global nexthop via
x.x.x.x dev eth2 weight 1 nexthop via x.x.x.x dev eth3 weight 1"

4) Ran "ip rule add fwmark 2024/0x7f8 lookup loadbalance"

Although the rule seems to fire fine, when the uplinks reach 100% of their
usage as per the QoS settings the machine freezes

Any ideas?

thanks

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

Jumping bean your java and linux experts
Cyber Connect - ADSL,3g,HSDPA,iBurst
VOIP, IP-PBX specialists
On Site IT Support

From forum: efw-user

QoS algorithm

2009-11-11T09:33:51Z

Hi all,

Just want to check the logic of the QoS default classes. If the high
priority class is not using its full capacity for its "reserved %" that
this bandwidth will be reallocated to lower priority traffic?

i.e the reserved % does not reserve the bandwidth if it is not used

regards

Mark

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

Jumping bean your java and linux experts
Cyber Connect - ADSL,3g,HSDPA,iBurst
VOIP, IP-PBX specialists
On Site IT Support

From forum: efw-user

how to install yum or any service in endian firewall?

2009-11-11T06:29:45Z

Hello.

First of all, thanks for the help =)

Well, I would like to install one service but I can´t install because the yum don´t work. the endian firewall is redhat based.

How can I install the one service? How can I install the yum?!

Thanks, best regard´s.

From forum: efw-user

How to install centos software on endian?

2009-11-11T06:00:34Z

Hi all,

I am sure this has been asked before but the internet is extremely slow at
the client premisses where I am. How does one install new software on
endian? i.e rpms from centos?

I assume endian 2.3 is running centos 5.3 or 5.4? Can I just download the
rpm and and go "rpm -iVUh"?

Is there an easier way?

thanks

Mark

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

Jumping bean your java and linux experts
Cyber Connect - ADSL,3g,HSDPA,iBurst
VOIP, IP-PBX specialists
On Site IT Support

From forum: efw-user

Re: Bridged VPN half working

2009-11-10T08:15:56Z

----- "compdoc" <compdoc@...> ha scritto:
> Try using not using a bridged connection and see if the
> problem goes away...

btw, how do I switch from bridget to routed? I couldn't find the option on the EFW 2.3 gui...

thanks
maxxer
--
Lorenzo Milesi - lorenzo.milesi@...

YetOpen S.r.l. - http://www.yetopen.it/
Via Previati 72 - 23900 Lecco - ITALY -
Tel 0341 220 205 - Fax 178 607 8199

GPG/PGP Key-Id: 0xE704E230 - http://keyserver.linux.it

-------- D.Lgs. 196/2003 --------

Si avverte che tutte le informazioni contenute in questo messaggio sono
riservate ed a uso esclusivo del destinatario. Nel caso in cui questo
messaggio Le fosse pervenuto per errore, La invitiamo ad eliminarlo
senza copiarlo, a non inoltrarlo a terzi e ad avvertirci non appena
possibile.
Grazie.

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Efw-user mailing list
Efw-user@...
https://lists.sourceforge.net/lists/listinfo/efw-user

From forum: efw-user