conf/102429: FreeBSD 6.1+VPN+ipnat+ipf: ÎÅ ÒÁÂÏÔÁÅÔ ÐÅÒÅÎÁÐÒÁ×ÌÅÎÉÅ ÐÏÒÔÏ× (portmapping)
Vadym
vikulin at unitedthinkers.com
Wed Aug 23 11:50:20 UTC 2006
>Number: 102429
>Category: conf
>Synopsis: FreeBSD 6.1+VPN+ipnat+ipf: ÎÅ ÒÁÂÏÔÁÅÔ ÐÅÒÅÎÁÐÒÁ×ÌÅÎÉÅ ÐÏÒÔÏ× (portmapping)
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Wed Aug 23 11:50:19 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator: Vadym
>Release: 6.1
>Organization:
United Thinkers
>Environment:
FreeBS.6.1-RELEASE FreeBSD 6/1 -RELEASE #0: Thu Jan 6 07:14:37 UTC 2000 root at FreeBSD.:/usr/src/sys/i386/compile/kernel_08_12_2006 I386
>Description:
åÓÔØ FreeBSD × ËÁÞÅÓÔ×Å ÒÏÕÔÅÒÁ ÄÌÑ ÓÅÔÉ 192.168.0.È.
ïÄÎÁ ÓÅÔÅ×ÁÑ ÓÍÏÔÒÉÔ × ÓÅÔØ ÐÒÏ×ÁÊÄÅÒÁ (IP ÓÅÔÅ×ÏÊ: 192.168.25.135).
÷ÔÏÒÁÑ - ÄÌÑ ÌÏËÁÌØÎÏÊ ÓÅÔÉ (IP: 192.168.0.1).
äÌÑ ÄÏÓÔÕÐÁ Ë ÐÒÏ×ÁÊÄÅÒÕ ÓÏÚÄÁÅÔÓÑ VPN ËÁÎÁÌ Ó 192.168.25.135 ÎÁ VPN ÓÅÒ×ÅÒ 192.168.25.1 (PPTP ËÌÉÅÎÔ). NAT ÒÁÂÏÔÁÅÔ ÎÁ ipnat c ipf
óÕÔØ ÐÒÏÂÌÅÍÙ ÔÁËÁÑ:
ÎÅ ÒÁÂÏÔÁÅÔ ÐÅÒÅÎÁÐÒÁ×ÌÅÎÉÅ ÐÏÒÔÏ× 21 É 80 ÎÁ ÁÄÒÅÓ ÌÏËÁÌØÎÏÇÏ ÓÅÒ×ÅÒÁ 192.168.0.5.
>How-To-Repeat:
éÓÈÏÄÎÙÅ ÄÁÎÎÙÅ ÔÁËÉÅ:
ðÒÉ ÐÏÄÎÑÔÉÉ VPN ÓÏÚÄÁÅÔÓÑ ÉÎÔÅÒÆÅÊÓ tun0 c ×ÎÅÛÎÉÍ IP: 195.39.x.x
ifconfig ÄÁÅÔ ÔÁËÏÅ
__________________________________________________________________________________________________________________
rl0: 192.168.0.1/24 active
rl1: 192.168.25.135/24 active
tun0:195.39.x.x->10.100.101.1
ping ÎÁ ÍÉÒ - × ÐÏÒÑÄËÅ
rc.conf
__________________________________________________________________________________________________________________
hostname=FreeBS.
nisdomainname="NO"
dhclient_program="/sbin/dhclient"
dhclient_flags=""
background_dhclient="NO"
firewall_enable="NO"
firewall_script="/etc/rc.firewall"
firewall_type="/etc/firewall.conf"
firewall_quiet="NO"
firewall_logging="NO"
firewall_flags=""
ip_portrange_first="NO"
ip_portrange_last="NO"
ike_enable="NO"
ike_program="/usr/local/sbin/isakmpd"
ike_flags=""
ipsec_enable="NO"
ipsec_file="/etc/ipsec.conf"
natd_program="/sbin/natd"
natd_enable="NO"
#natd_interface="rl1"
#natd_flags="-redirect_port tcp 192.168.0.5:21 21"
#natd_flags="-a 192.168.25.1"
#natd_flags="-f /etc/natd.conf"
ipfilter_enable="YES"
ipfilter_program="/sbin/ipf"
ipfilter_rules="/etc/ipf.rules"
ipfilter_flags=""
ipnat_enable="YES"
ipnat_program="/sbin/ipnat"
ipnat_rules="/etc/ipnat.rules"
ipnat_flags=""
ipmon_enable="YES"
ipmon_program="/sbin/ipmon"
ipmon_flags="-Ds"
ipfs_enable="YES"
ipfs_program="/sbin/ipfs"
ipfs_flags=""
pf_enable="NO"
pf_rules="/etc/pf.conf"
pf_program="/sbin/pfctl"
pf_flags=""
pflog_enable="NO"
pflog_logfile="/var/log/pflog"
pflog_program="/sbin/pflogd"
pflog_flags=""
pfsync_enable="NO"
pfsync_syncdev=""
pfsync_ifconfig=""
tcp_extensions="YES"
log_in_vain="0"
tcp_keepalive="YES"
tcp_drop_synfin="NO"
icmp_drop_redirect="YES"
icmp_log_redirect="YES"
network_interfaces="rl0 rl1 tun0 ng0"
cloned_interfaces=""
sppp_interfaces=""
gif_interfaces="NO"
ppp_enable="NO"
ppp_program="/usr/sbin/ppp"
ppp_mode="auto"
ppp_nat="YES"
ppp_profile="papchap"
ppp_user="root"
hostapd_enable="NO"
syslogd_enable="YES"
syslogd_program="/usr/sbin/syslogd"
syslogd_flags="-s"
inetd_enable="NO"
inetd_program="/usr/sbin/inetd"
inetd_flags="-wW -C 60"
#
# named. It may be possible to run named in a sandbox, man security for
# details.
#
named_enable="NO"
named_program="/usr/sbin/named"
#named_flags=""
named_pidfile="/var/run/named/pid"
named_uid="bind"
named_chrootdir="/var/named"
named_chroot_autoupdate="YES"
named_symlink_enable="YES"
defaultrouter=192.168.25.1
static_routes=""
natm_static_routes=""
gateway_enable="YES"
router_enable="NO"
router="/sbin/routed"
router_flags="-q"
mrouted_enable="NO"
mrouted_flags=""
ipxgateway_enable="NO"
ipxrouted_enable="NO"
ipxrouted_flags=""
arpproxy_all="NO"
forward_sourceroute="NO"
accept_sourceroute="NO"
### Miscellaneous network options: ###
icmp_bmcastecho="NO"
if [ -z "${source_rc_confs_defined}" ]; then
source_rc_confs_defined=yes
source_rc_confs () {
local i sourced_files
for i in ${rc_conf_files}; do
case ${sourced_files} in
*:$i:*)
;;
*)
sourced_files="${sourced_files}:$i:"
if [ -r $i ]; then
. $i
fi
;;
esac
done
}
fi
ifconfig_rl0="inet 192.168.0.1 netmask 0xffffff00"
ifconfig_rl1="inet 192.168.25.135 netmask 0xffffff00"
ifconfig_lo0="inet 127.0.0.1"
__________________________________________________________________________________________________________________
ppp.conf
__________________________________________________________________________________________________________________
vpn:
dns enable
nat enable yes
set authname nikolay
set authkey 911
set timeout 0
set ifaddr 0 0
add default HISADDR
__________________________________________________________________________________________________________________
ipnat.rules
__________________________________________________________________________________________________________________
rdr tun0 195.39.253.24/32 port 21 -> 192.168.0.5 port 21
rdr tun0 195.39.253.24/32 port 80 -> 192.168.0.5 port 80
map tun0 192.168.0.0/24 -> 195.39.253.24/32 proxy port ftp ftp/tcp
map tun0 192.168.0.0/24 -> 195.39.253.24/32 portmap tcp/udp 10000:60000
map tun0 192.168.0.0/24 -> 195.39.253.24/32
__________________________________________________________________________________________________________________
ipf.rules
__________________________________________________________________________________________________________________
pass in all
pass out all
__________________________________________________________________________________________________________________
ÄÌÑ ÓÏÅÄÉÎÅÎÉÑ Ó ftp ÓÅÒ×ÅÒÁ(192.168.0.5) ÎÁ ÐÏÒÔ 21
tcpdump rl0 ÄÁÅÔ ÔÁËÏÅ:
__________________________________________________________________________________________________________________
08:38:19 3528202 arp who-has 192.168.0.1 tell 192.168.0.5
352829 arp replay 192.168.0.1 is-at 00:02:44:66:05:a1 (oi Unknown)
352925 IP 192.168.0.5.4332 > 195.39.253.24.ftp: S 2706215230:2706215230 (0) win 65535 <msss 1460,nop, nop, sack Ok>
352969 IP 195.39.x.x.ftp: > 192.168.0.5.4332: R 0:0(0) ack 2706215231 win 0
813373 IP 192.168.0.5.4332 > 195.39.x.x.ftp : S 2706215230:2706215230 (0) win 65535 <mss 1460, nop, nop,sackOk>
813400 IP 195.39.x.x.ftp > 192.168.0.5.4332 : R 0:0(0) ack 1 win 0
316291 IP 192.168.0.5.4332 > 195.39.x.x.ftp : S 2706215230:2706215230 (0) win 65535 <mss 1460, nop, nop, sackOk>
316324 IP 195.39.x.x.ftp > 192.168.0.5.4332 : R 0:0(0) ack 1 win 0
__________________________________________________________________________________________________________________
áÎÁÌÏÇÉÞÎÏ É ÄÌÑ ÐÏÒÔÁ 80.
>Fix:
îÅ ÉÚ×ÅÓÔÎÏ
>Release-Note:
>Audit-Trail:
>Unformatted:
More information about the freebsd-bugs
mailing list