HOWTO Ping LAN???

[Matthew Seaman]

On Thu, Jul 29, 2004 at 10:27:05AM -0400, Hakim Singhji wrote:
> Hi Matt,
> 
> You say that the only way I will be able to connect to my network is by tunneling.  
> This is not what I want to do, I thought I may be able to SSH, Telnet, www, etc. 
> from the outside to my default gateway and have the gateway pass SSH, Telnet, 
> www., or any other request to the machine on the private network by including the 
> "localhost.defaultgateway.domain.org" or something to that affect.
> 
> Does NAT Overloading only go one way???


Essentially, yes.  What you're after is called 'port forwarding'
(which is actually a class of tunnelling methods).

What you can't do in the sort of setup you describe is ssh(1) to the
gateway machine and have it connect you to some arbitrary machine on
your internal network.  The outside world doesn't "know" anything
about the arrangement of your private network: which machine should
the gateway box forward the incoming connection to?  All it sees is a
TCP syn packet sent to port 22 on its internet interface.

Going the other way round -- where the internal machine initiates the
connection -- works because you can match up the response 'ACK' packet
to the outgoing 'SYN' packet

In order to allow remote access to your private machines you've
somehow got to introduce a mechanism to permit the gateway machine to
know which of the internal machines you want to connect to.  You can
set up non-standard ports on the NAT gateway to forward connections to
internal machines: eg.

     Port:  Destination:
     ----------------------
     2201   192.168.0.1:22
     2202   192.168.0.2:22
     2203   192.168.0.3:22

(see natd(8) 

but a) you'ld have to do that for each service on each machine you
want connectivity to, and b) it's not going to work in the specific
case of ssh(1) specifically, because ssh(1) attempts to verify the
identity of the host it connects to against the host keys presented to
it during the SSH connection. 

Probably the easiest thing to do is log into your gateway machine via
ssh(1) and then take a second hop from there to your internal
machines.  telnet(1) is generally a bad idea for security
reasons. ping(8) which operates via ICMP echo request is completely
out: ICMP doesn't have the concept of port numbers at all, so there's
no way to clue the NAT gateway into which machine you want to
communicate with.

	Cheers,

	Matthew

-- 
Dr Matthew J Seaman MA, D.Phil.                       26 The Paddocks
                                                      Savill Way
PGP: http://www.infracaninophile.co.uk/pgpkey         Marlow
Tel: +44 1628 476614                                  Bucks., SL7 1TH UK
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20040729/996e6d25/attachment.bin