Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 12 replies
  • Subscribers 2 subscribers
  • Views 2144 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[7.101] Nat configuration question

etrigan63
Hey all,
just set up my ASG server and my kids cannot access the site clubpenguin.com. According to the site, I have to open ports 3724, 6112, 6113 & 9875. I thought I did this, but I have been able to grant them access. Any pointers will be greatly appreciated.


This thread was automatically locked due to age.
Parents
  • 0
    What are your NAT and PacketFilter settings?

    Barry
  • 0 in reply to BarryG
    OK from the beginning:

    Definitions
    Services:
    Clubpenguin3724 - TCP 1:65355 -> 3724
    Clubpenguin6112 - TCP 1:65355 -> 6112
    Clubpenguin6113 - TCP 1:65355 -> 6113
    Clubpenguin9875 - TCP 1:65355 -> 9875
    Clubpenguin -> Group of the above protocols

    Hosts:
    Carlitos -> ip of my son's pc (192.168.x.x)

    DNAT
    Traffic Source: Any
    Traffic Service: Clubpenguin
    Traffic Destination: External/WAN(Address)
    Destination: Carlitos

    Packet Filters
    Source: Any
    Service: Clubpenguin
    Destination: Carlitos
Reply
  • 0 in reply to BarryG
    OK from the beginning:

    Definitions
    Services:
    Clubpenguin3724 - TCP 1:65355 -> 3724
    Clubpenguin6112 - TCP 1:65355 -> 6112
    Clubpenguin6113 - TCP 1:65355 -> 6113
    Clubpenguin9875 - TCP 1:65355 -> 9875
    Clubpenguin -> Group of the above protocols

    Hosts:
    Carlitos -> ip of my son's pc (192.168.x.x)

    DNAT
    Traffic Source: Any
    Traffic Service: Clubpenguin
    Traffic Destination: External/WAN(Address)
    Destination: Carlitos

    Packet Filters
    Source: Any
    Service: Clubpenguin
    Destination: Carlitos
Children
  • 0 in reply to etrigan63
    What does the packetfilter log show?

    Are you sure those are supposed to all be TCP and not UDP?

    Do you have MASQ setup, and a packetfilter rule to allow outgoing traffic?

    Barry
  • 0 in reply to BarryG
    The packetfilter log is utterly unreadable in Notepad.

    I did not have a packetfilter rule allowing outbound traffic. I have corrected this. That did not fix the problem though. Can the site be exempted from being cached?
  • 0 in reply to etrigan63
    Try loading the log into Excel, and do "text to columns" on Spaces.
    Or, just use Astaro's "live log" viewer.

    If you're worried about the http cache, try disabling it temporarily.

    Have you setup Masquerading for the internal network?

    Barry
  • 0 in reply to BarryG
    An Internal -> External Masq rule has been set up.
  • 0 in reply to etrigan63
    Hi,
    most of your problems appear to be with your packet filter. Change the way the packet filter is pointing eg your son's pc-> penguin -> any -> allow.

    The ports are needed for originating outgoing and the ASG will allow returning traffic to those ports.

    Ian M[[[:)]]][[[:)]]][[[:)]]]
  • 0 in reply to RFCat_vk_01
    If this thing runs completely in the browser, it's possible the http proxy is interfering... Are you using the proxy? Have you tried disabling it or creating an exception?

    Barry
  • 0 in reply to BarryG
    Creating an exception did nothing, however, disabling the http proxy worked. I wonder why the exception didn't work?
  • 0 in reply to etrigan63
    Found the problem but I don't know how to fix it.
    2007:12:28-13:04:03 (none) httpproxy[6530]: id="0060" severity="info" sys="SecureWeb" sub="http" name="web request blocked, forbidden category detected" action="block" method="GET" srcip="192.168.0.52" user="" statuscode="403" cached="0" profile="profile_0" filteraction="action_REF_DefaultHTTPCFFAction" size="2688" time="91 ms" request="0x94e4670" url="http://209.213.108.10/crossdomain.xml" error="" reason="category" category="1710" categoryname="Uncategorized"

    For some reason my ASG is blocking uncategorized URL's in spite of the fact that I do not have that feature selected.
  • 0 in reply to etrigan63
    Got it!

    In the Content Filter list of subjects there is an option called "Suspicious & Uncategorized Websites". Checking this overrides unchecking "Block all Uncategorized Websites" below it.

    Now all I need is a example of publishing a web server and a pop3 server and I am done.
  • 0 in reply to etrigan63
    For the servers, you just need DNAT settings and matching Packetfilter rules for the incoming traffic.

    The docs/knowledgebase have plenty of examples, or ask here if you get stuck.

    Barry