This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Packet Filter

Because of the great help, here in these Forum (thx to Perth..) i'd like to ask another question:

Last night i've installed the ASL for the first time and i was quite lucky as the connections worked pretty well. To understand my Problem i will short design my situation:

1. i've configured following Networks:
DMZ (192.168.124.254)
LAN (192.168.125.254)
WAN (192.168.123.254)

2. i did a Masquerading Rule:
Name¦Match Parameters¦SRC translation¦DST Translation
LAN_MASQ¦LAN_NETWORK__ -> ALL/ALL¦MASQ_WAN¦None

3. i did following Packet filter rule:
From (Client)¦Service¦To (Server)¦Action
LAN_Network__¦Any¦WAN_Network__¦Allow

and now my problem: this rule as described above didnt work. So far so bad. Because i don't really understand this well i've played a bit around and found following rule wich worked fine:

From (Client)¦Service¦To (Server)¦Action
LAN_Network__¦Any¦Any¦Allow

Now my Question: Can anybody explain this mysterium to me as bloody noob?

Thx to all...

This thread was automatically locked due to age.

Parents

0 martindw over 22 years ago

My first-off guess (and I'm far from the most expert member of this board) is that you were trying to access a web page or something out on the wide world that was not on the WAN_Network IP space.  This is fairly likely since no public IP space is 192.168.x.x.

So, let's say you're trying to hit Yahoo with your browser.  That would be from your internal network 192.168.125.x using port 80 and going to a destination of (at least according to my DNS right now) 64.58.79.230.  Since that's nothing at all like 192.168.123.x the rule you described will drop the packet.

In other words, for you to get a useable rule for websurfing, you have to allow packets from your LAN network using port 80 to go to destination "Any."

HTH,

Dan
Cancel
Vote Up 0 Vote Down

Cancel
0 uzweifel over 22 years ago in reply to martindw

Yes, i've tried to reach www.google.ch [:)].
But with the 'Any' Rule, Computer from the 'LAN'-Zone will automatically reach the 'DMZ'-Zone, right?
Cancel
Vote Up 0 Vote Down

Cancel
0 gnujuba over 22 years ago in reply to uzweifel

of course, "any" means any.

if dont want access from your internal lan to the dmz you have to setup a deny rule like :

LAN  -> DMZ any Action[:D]eny
and put it above the allow rule.

it would be nice if you could not only use  ports and ips in rules but also the incoming and outgoing interface .

greets,
gnjb
Cancel
Vote Up 0 Vote Down

Cancel
0 Simon Shaw over 22 years ago in reply to gnujuba

You can do this by specifying the interface in the rule.

Your interfaces should be listed...
Cancel
Vote Up 0 Vote Down

Cancel
0 uzweifel over 22 years ago in reply to Simon Shaw

Great! Thx a lot... I begin to understand [:)]
Cancel
Vote Up 0 Vote Down

Cancel
0 alda over 22 years ago in reply to Simon Shaw

Where I can define in rules interface ? This possibility on page "Rules" isn't !?
Cancel
Vote Up 0 Vote Down

Cancel
0 gnujuba over 22 years ago in reply to Simon Shaw

hi simon,

you can not choose the interface in when creating a rule, or am i blind ?

gnjb
Cancel
Vote Up 0 Vote Down

Cancel
0 Simon Shaw over 22 years ago in reply to gnujuba

Interface should already be defined.

(They are created when you create an interface in Networking). Like :
eth0_Interface__
ADSL_Interface__
etc...
Cancel
Vote Up 0 Vote Down

Cancel
0 gnujuba over 22 years ago in reply to Simon Shaw

yes, of course you can use the interface in a rule as source or destination.
what i meant was, that it would be nice if you could define a rule like this:

"source ip/net" "incoming interface" -> "dest ip/net" "outgoing interface" : "service/port" : "action"

that would solve the problem described in the first post ...

by,
gnjb
Cancel
Vote Up 0 Vote Down

Cancel
0 uzweifel over 22 years ago in reply to gnujuba

that was my first thought. but now, i think i can live with the rule as described above.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 uzweifel over 22 years ago in reply to gnujuba

that was my first thought. but now, i think i can live with the rule as described above.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data