This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DNAT - ran out of ideas

Hello all.

I've configured several ports to Allow through the firewall
but the ports are still being blocked.

Okay, I've already read the how-tos, manuals, etc. and I
already have common ports open and allowed through the
firewall; ie, HTTP, HTTPS, SMTP, POP3, without a hitch.

I created a new service, wow1 port 3724, and when I tried
testing it to see if it goes through, it's still being blocked.
This port is created simillarly to the HTTP port and is also
destined to the same host. See the following:


Services:[/u]

  	 Name  	 Protocol  	 Source Port  	 Destination Port 

	HTTP 	TCP 		 1024:65535 	 80

	wow1 	TCP		 1:65535	 3724



NAT Rules[/u]

State Name	Match Parameters                    SRC Translation     DST Translation	 

web_services	Any -> external (Address) / HTTP    None                amed / HTTP	 	

wow1	 	Any -> external (Address) / wow1    None                amed / wow1	 	

	 

Packet Filter:[/u]

		Group 		Source 		Service 	Action    Destination 	

1		[none]		Any		wow1	        Allow	  amed

2		[none]		Any		HTTP	        Allow     amed			



Testing:[/u]

Port	Status		Protocol and Application[/u]

80 	OPEN! 		World Wide Web HTTP

3724 	Closed 		battlenet

[/code]



When I test my firewall using an internet port test, it sees port 80 open

but port 3724 closed. Considering these two ports are created simillar,

what am I missing or misconfigured?



Any ideas or suggestions is appreciated, fast. I'm losing lots of hairs... :{



Thanks!

jav

This thread was automatically locked due to age.

Parents

0 Simon Shaw over 19 years ago

The rule should be:

Source: Any
Service: wow1
Destination: (FIREWALL EXTERNAL INTERFACE IP)

Then the NAT rule should grab the traffic.
(Hint check the live filter log).

Also, suggest you don't alter the destination protocol unless you need to, just set it to the default Unchanged or whatever it is.
Cancel
Vote Up 0 Vote Down

Cancel

0 javelin over 19 years ago in reply to Simon Shaw

Okay, I changed the Destination to my external interface and also put the
destination protocol to Unchanged per your suggestion.


Packet Filter Rules

   Group   Source   Service   Action   Destination

	

1 [none]   Any      wow1      Allow    inwall (Address)  





NAT Rules 	  

Name   Match Parameters                  SRC Translation      DST Translation	

wow1   Any -> inwall (Address) / wow1    None                 amed

I've tested the port again and monitored live packet filter log. It's coming in
but it's still being dropped:


Live Packet Filter Log



08:49:01 	4.79.142.206 	48280 	-> 	24.107.nnn.nnn 	3274 	TCP 	40 	 	120 	WINDOW=8192 RES=0x00 SYN URGP=0



or



2006:05:29-08:49:01 (none) kernel: DROP: IN=eth2 OUT= MAC=00:50:fc:78:3d:41:00:05:00:e4:88:fd:08:00 SRC=4.79.142.206 DST=24.107.nnn.nnn LEN=40 TOS=0x00 PREC=0x00 TTL=120 ID=32768 PROTO=TCP SPT=48280 DPT=3274 WINDOW=8192 RES=0x00 SYN URGP=0

Packet filter rule clearly states to allow the port through. What else can I look at or change to make this work?

Any other ideas or suggestion is much appreciated...

Thanks!
jav

Reply

0 javelin over 19 years ago in reply to Simon Shaw

Okay, I changed the Destination to my external interface and also put the
destination protocol to Unchanged per your suggestion.


Packet Filter Rules

   Group   Source   Service   Action   Destination

	

1 [none]   Any      wow1      Allow    inwall (Address)  





NAT Rules 	  

Name   Match Parameters                  SRC Translation      DST Translation	

wow1   Any -> inwall (Address) / wow1    None                 amed

I've tested the port again and monitored live packet filter log. It's coming in
but it's still being dropped:


Live Packet Filter Log



08:49:01 	4.79.142.206 	48280 	-> 	24.107.nnn.nnn 	3274 	TCP 	40 	 	120 	WINDOW=8192 RES=0x00 SYN URGP=0



or



2006:05:29-08:49:01 (none) kernel: DROP: IN=eth2 OUT= MAC=00:50:fc:78:3d:41:00:05:00:e4:88:fd:08:00 SRC=4.79.142.206 DST=24.107.nnn.nnn LEN=40 TOS=0x00 PREC=0x00 TTL=120 ID=32768 PROTO=TCP SPT=48280 DPT=3274 WINDOW=8192 RES=0x00 SYN URGP=0

Packet filter rule clearly states to allow the port through. What else can I look at or change to make this work?

Any other ideas or suggestion is much appreciated...

Thanks!
jav

Children

No Data