From owner-freebsd-security Fri Apr 21 11:21:18 2000 Delivered-To: freebsd-security@freebsd.org Received: from eastwood.aldigital.algroup.co.uk (eastwood.aldigital.algroup.co.uk [194.128.162.193]) by hub.freebsd.org (Postfix) with ESMTP id F046037BD7C for ; Fri, 21 Apr 2000 11:21:09 -0700 (PDT) (envelope-from adam@algroup.co.uk) Received: from algroup.co.uk (socks-fw.aldigital.co.uk [192.168.254.10]) by eastwood.aldigital.algroup.co.uk (8.8.8/8.6.12) with ESMTP id SAA14505; Fri, 21 Apr 2000 18:20:47 GMT Message-ID: <39009AA1.4880F38F@algroup.co.uk> Date: Fri, 21 Apr 2000 19:14:57 +0100 From: Adam Laurie X-Mailer: Mozilla 4.61 [en] (Win98; I) X-Accept-Language: en MIME-Version: 1.0 To: Ron Smith Cc: freebsd-security@FreeBSD.ORG Subject: Re: Using proxys with ipfw References: <20000421175830.78962.qmail@hotmail.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Ron Smith wrote: > > Hello All, > > I'm trying to determine if it's possible to implement smtp/pop, ftp, and www > proxys with ipfw rules in place. If it is possible, which proxy software > would be the best to use. I have a dual-homed gateway with ipfw rules in > place. Everything works great , but I only have access to and from the > Internet with NAT, at this point. I would like to add the ability to access > a mail server behind a firewall from the outside world. I would also like to > do the same for www and ftp services as well. Any pointers? Assuming you are using natd, try 'man natd' - the interesting bit being: -redirect_port proto targetIP:targetPORT [aliasIP:]aliasPORT [re- moteIP[:remotePORT]] Redirect incoming connections arriving to given port to an- other host and port. Proto is either tcp or udp, targetIP is the desired target IP number, targetPORT is the desired tar- get PORT number, aliasPORT is the requested PORT number and aliasIP is the aliasing address. RemoteIP and remotePORT can be used to specify the connection more accurately if neces- sary. For example, the argument tcp inside1:telnet 6666 means that tcp packets destined for port 6666 on this machine will be sent to the telnet port on the inside1 machine. cheers, Adam -- Adam Laurie Tel: +44 (181) 742 0755 A.L. Digital Ltd. Fax: +44 (181) 742 5995 Voysey House Barley Mow Passage http://www.aldigital.co.uk London W4 4GB mailto:adam@algroup.co.uk UNITED KINGDOM PGP key on keyservers To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message