Hi people,
I have been searching the forums high and low for hours now, to see what the heck is going on. I haven't had any luck. [:S]
OK. At midnight last night, I started using the DMZ for the first time. Before this, All I had been using was the internal network (7 client machines, 1 astaro router... the normal stuff). I wanted to get a server in the DMZ to run some services like ftp, psybnc, and teamspeak.
All went well. The server goes straight into the DMZ NIC, with a crossover cable. Rather than tell you what I ADDED to the packet filter/NAT/masq rules, I'll give the whole lot, just incase I've done something really stupid.
Sorry for the length.
=====================================================
NAT/Masquarading
================
Name: DMZ
Rule Type: Masquarading
Network: DMZ_Interface_Network__
Interface: Cable_Modem
Name: DMZ_Internal_Access
Rule Type: Masquarading
Network: Internal_Network__
Interface: DMZ_Interface
Name: DMZ_NAT
Rule Type: DNAT/SNAT
Source Address: DMZ_Interface_Interface__
Destination Address: :: No Match ::
Service: Any
Change source to: :: MASQ on 'Cable_Modem' ::
Change destination to: :: No Change ::
Name: DMZ_NAT2
Rule Type: DNAT/SNAT
Source Address: Cable_Modem_Interface__
Destination Address: :: No Match ::
Service: Any
Change source to: :: MASQ on 'DMZ_Interface' ::
Change destination to: :: No Change ::
Name: EXODUS-TS
Rule Type: DNAT/SNAT
Source Address: Any
Destination Address: Cable_Modem_Interface__
Service: EXODUS-TS2
Change source to: :: No Change ::
Change destination to: EXODUS
Service destination: EXODUS-TS2
Name: FTP
Rule Type: DNAT/SNAT
Source Address: Any
Destination Address: Cable_Modem_Interface__
Service: FTP
Change source to: :: No Change ::
Change destination to: EXODUS
Service destination: FTP
Name: FTP-RANGE
Rule Type: DNAT/SNAT
Source Address: Any
Destination Address: Cable_Modem_Interface__
Service: FTP-PASV-RANGE
Change source to: :: No Change ::
Change destination to: EXODUS
Service destination: FTP-PASV-RANGE
Name: LAN
Rule Type: Masquarading
Network: Internal_Network__
Interface: Cable_Modem
Name: LAN-NAT
Rule Type: DNAT/SNAT
Source Address: Internal_Interface__
Destination Address: :: No Match ::
Service: Any
Change source to: Cable_Modem_Interface__
Change destination to: :: No Change ::
Service destination: :: No Change ::
Name: LAN-NAT2
Rule Type: DNAT/SNAT
Source Address: Cable_Modem_Interface__
Destination Address: :: No Match ::
Service: Any
Change source to: :: MASQ on 'Internal' ::
Change destination to: :: No Change ::
Static routes
=============
:: no additional static routes defined ::
Packet Fileter
==============
From: Cable_Modem_Network__
To: Internal_Network
Service: service_135
Action: Drop
From: Internal_Network__
To: Any
Service: Any
Action: Allow
From: DMZ_Interface_Network__
To: Any
Service: Any
Action: Allow
From: Any
To: Any
Service: FTP
Action: Allow
From: Internal_Network__
To: DMZ_Interface_Network__
Service: Any
Action: Allow
From: Any
To: Any
Service: FTP-PASV-RANGE
Action: Allow
From: Any
To: Any
Service: EXODUS-TS2
Action: Allow
From: Cable_Modem_Network__
To: DMZ_Interface_Network__
Service: Any
Action: Allow
=====================================================
For reference, EXODUS is my server on the DMZ. For example, the service EXODUS-TS2 is the TeamSpeak2 service port. I still haven't got that one working actually [:S]
Righty. The problem. Looking at my reports on the Astaro box, around the time the DMZ was activated, the connections just went MENTAL. We have never really had more than 1000 connections. It used to average at about 210. Now, we have a constant number of connections of 14000 ish. Obviously this value changes, but its worrying me. Nobody on the internal network could possibly be doing this.
The actual machine is an old Compaq 850R - P200MMX, 196MB Ram. I'm not using proxies, and the cpu usage used to be about 25%. Now its just over 50%. This makes sense since its working for two networks rather than one, but I can't look at connection tracking or anything.
I think I may have defined a loop somewhere in the NAT? So that connections are being sent round in an endless route? [:S]
Any help would be greatly appreciated.
MidgetmanUK
P.S As you may have figured, I don't exactly know what I'm doing. I think I bodged up the Masquarading definitions [:$]
This thread was automatically locked due to age.
