>>You forward this traffic with IPPORTFW and not the forward setup within
>>IPFWADM or IPCHAINS.
>
>Even though the web server has a valid ip? Why would it work if forwarding
>is set to default accept?
Oh.. if the internal WWW server has a real valid IP.. yes.. you should
use IPFWADM/IPCHAINS forwarding vs. IPPORTFW.
>What I'm trying to find is an explicit allow for traffic going to the web
>server.
>ipfwadm -F -a accept -S $universe/0 -D $server/32
>doesn't work.
Do you have a set of lines at the bottom of your ruleset that
says:
--
# Final INPUT Rule
#
# catch all rule, all other incoming is denied and logged. pity there is no
# log option on the policy but this does the job instead.
/sbin/ipfwadm -I -a reject -S $universe/0 -D $universe/0 -o
# catch all rule, all other outgoing is denied and logged. pity there is no
# log option on the policy but this does the job instead.
#
# This should catch everything including SAMBA an all non-explictly allowed
# TELNET, FTP, FTP-DATA, SSH, etc.
/sbin/ipfwadm -O -a reject -S $universe -D $universe -o
# catch all rule, all other forwarding is denied and logged. pity there is no
# log option on the policy but this does the job instead.
/sbin/ipfwadm -F -a reject -S $universe/0 -D $universe/0 -o
--
once you run these and you STILL cannot forward traffic through, you should
get logs in /var/log/messages telling you why.
--David
.----------------------------------------------------------------------------.
| David A. Ranch - Linux/Networking/PC hardware [EMAIL PROTECTED] |
!---- ----!
`----- For more detailed info, see http://www.ecst.csuchico.edu/~dranch -----'
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
http://tiffany.indyramp.com/mailman/listinfo/masq
Admin requests can be handled by web (above) or [EMAIL PROTECTED]
