Date: Thu, 02 Apr 2015 05:31:32 +0900 (JST) From: Hiroki Sato <hrs@allbsd.org> To: hiroo.ono+freebsd@gmail.com, chaltier@agate.plala.or.jp Cc: freebsd-users-jp@freebsd.org Subject: [FreeBSD-users-jp 95501] Re: =?iso-2022-jp?b?aXBmdxskQiRHRkNEahsoQklQGyRCMEozMCROQFwbKEI=?= =?iso-2022-jp?b?GyRCQjMkckU+QXckNyQ/JCQbKEI=?= Message-ID: <20150402.053132.1512763590932251857.hrs@allbsd.org> In-Reply-To: <CANtk6SgbFQ8AbVPazrLm_KPtK_Hcyvm-N0wAaD7JTfco4_2Ztg@mail.gmail.com> <20150331212326.2783.A7D5A726@agate.plala.or.jp> References: <20150330.003733.1964185496119167015.inetd@x.inetd.co.jp> <20150331.013014.1399253678235921793.inetd@x.inetd.co.jp> <CANtk6SgbFQ8AbVPazrLm_KPtK_Hcyvm-N0wAaD7JTfco4_2Ztg@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
----Security_Multipart(Thu_Apr__2_05_31_32_2015_000)--
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit
$B:4F#$G$9!#(B
Hiroo Ono ($B>.Ln42@8(B) <hiroo.ono+freebsd@gmail.com> wrote
in <CANtk6SgbFQ8AbVPazrLm_KPtK_Hcyvm-N0wAaD7JTfco4_2Ztg@mail.gmail.com>:
hi> 2015$BG/(B3$B7n(B31$BF|(B 1:30 <zen-freebsd-users@suzuki.que.ne.jp>:
hi> > $BNkLZ!w3k>~6h$G$9!#(B
hi> > $B$J$s$+!":G=i$N$4<ALd$r;dFI$_0c$($F$^$9$M!#!#!#%j%b!<%H$X$NE>Aw$HBgJQ$J(B
hi> > $B4*0c$$$G!#!#(B
hi> >
hi> > fwd 127.0.0.1,2222 $B$J$N$G%m!<%+%k$X$NE>Aw$J$N$G(Bnat$B$r;H$&$^$G$b$J$/%k!<(B
hi> > $B%k$K%^%C%A$9$l$P(B2222$B$KE>Aw$5$l$k$O$:$G$9$M!#!#!#(B
hi>
hi> $B;d$b$=$&;W$C$F$O$8$a$O%3%a%s%H$9$k$N$r95$($?$N$G$9$,!"!V(BBSD$B%+!<%M%k$N(B
hi> $B@_7W$H<BAu!W(B13.4$B@a$K(B
hi> $B!H%[%9%H$,J#?t$N%"%I%l%9$r;}$C$F$$$k>l9g!"%Q%1%C%H$O$=$NAw?.@h$,$3$l$i(B
hi> $B$N$I$l$+$K0lCW$9$l$P<u$1F~$l$i$l$k!#!I(B
hi> $B$H$"$j$^$9$N$G!"(B127.0.0.1:2222 $B$KFO$$$?$1$l$I$b!"%Q%1%C%H$N08@h%"%I%l(B
hi> $B%9$H%]!<%HHV9f$r8+$F(B
hi> 192.168.11.3:22 $B08$N%Q%1%C%H$H$$$&=hM}$,$5$l$F$$$k$N$G$O$J$$$+$H;W$$$^(B
hi> $B$9!#(B
hi> $B$H$$$&$3$H$G!"%Q%1%C%H$r=q$-49$($k(B NAPT $B$,I,MW$H$$$&;XE&$O@5$7$$$O$:$G(B
hi> $B$9!#(B
hi> $B$h$/$o$+$C$F$$$^$;$s$,!#(B
$B$3$N%1!<%9$O%m!<%+%k$X$NE>Aw$G$9$N$G!"(BNAPT $B$OI,MW$"$j$^$;$s!#(B
$B<!$N>r7o(B
- 127.0.0.1:2222 $B$G(B listen $B$7$F$$$k(B sshd $B$H!"(B
192.168.11.3:22 $B$G(B listen $B$7$F$$$k(B sshd $B$,!"$=$l$>$l(B
$BF10l$N%[%9%H(B ($B0J9_%[%9%H(B B $B$H8F$S$^$9(B) $B$KB8:_$7$F$$$k(B
- $B%[%9%H(B B $B$N(B IPFW $B$N(B fwd $B%k!<%k$G!"(B192.168.11.3:22 $B08$N%Q%1%C%H$,(B
127.0.0.1:2222 $B$KE>Aw$5$l$k(B
$B$,K~$?$5$l$k>l9g!"JL$N%[%9%H(B 192.168.11.2 ($B0J9_%[%9%H(B A $B$H(B
$B8F$S$^$9(B) $B$+$i$N(B TCP $B@\B3MW5a$O!"<!$N$h$&$JF0:n$K$J$j$^$9!#(B
1. $B;OE@(B 192.168.11.2:E, $B=*E@(B 192.168.11.3:22 $B$N(B
TCP SYN $B$,(B A $B$+$i(B B $B$KAw$i$l$k!#!J(BE $B$O(B ephemeral port$B!K(B
2. IPFW $B$,%[%9%H(B B $B>e$G(B 1. $B$N%Q%1%C%H$r(B 127.0.0.1:2222 $B$KE>Aw$9$k!#(B
$B$3$N;~!"(Bfwd $B%k!<%k$O!"%Q%1%C%H$N;OE@!&=*E@%"%I%l%9$r=q$-49$($J$$$?$a!"(B
$B<B:]$K$O(B 127.0.0.1:2222 $B$KAw$i$l$k$K$b4X$o$i$:!"(B
$B%[%9%H(B B $B$N%M%C%H%o!<%/%9%?%C%/$,(B socket $B%l%Y%k$GG'<1$9$k(B
$B=*E@%"%I%l%9$O(B 192.168.11.3:22 $B$N$^$^$G$9!#(B
3. 2222 $B%]!<%H$G(B listen $B$7$F$$$k(B sshd $B$O!"%Q%1%C%H$r<u$1<h$C$F(B
accept(2) $B$r%3!<%k$7!"@\B3MQ$N?7$7$$(B socket $B$r@8@.$9$k!#(B
$B$3$N<u$1<h$C$?%Q%1%C%H$O!"(B192.168.11.2:E -> 192.168.11.3:22 $B$H$$$&(B
$B;OE@!&=*E@%"%I%l%9$H$7$F2r<a$5$l$k$?$a!"%[%9%H(B B $B$+$i$N(B
TCP SYN+ACK $B$NJVAw$O!"5UE>$7$F(B 192.168.11.3:22 -> 192.168.11.2:E $B$K(B
$B$J$j$^$9!#(B
$B$D$^$j!"@\B3MQ$N?7$7$$(B socket $B$K$O!"%T%"$N;OE@$H$7$F(B
127.0.0.1:2222 $B$G$O$J$/!"(B192.168.11.3:22 $B$,@_Dj$5$l$^$9!#(B
$B$7$?$,$C$F!"<B:]$K%Q%1%C%H$O(B 127.0.0.1:2222 $B$KE>Aw$5$l$F$$$k$K$b4X$o$i$:!"(B
- A->B $BJ}8~$NDL?.$O(B 192.168.11.2:E -> 192.168.11.3:22
- B->A $BJ}8~$NDL?.$O(B 192.168.11.3:22 -> 192.168.11.2:E
$B$H$$$&%"%I%l%9$K%Q%1%C%H$,N.$l$F$$$k$h$&$K8+$($k$3$H$K$J$j!"(B
$B%"%W%j%1!<%7%g%s$+$i$O!"E>Aw$N;v<B$O8+$($^$;$s!#(B
sshd $B$J$I$N%G!<%b%s$O(B accept $B$7$?;~E@$G@\B3MQ$N(B socket $B$+$i(B
$BDL?.Aj<j$N%"%I%l%9!&%]!<%HHV9f$r<hF@$7$^$9$,!"(B
$BF@$i$l$k%T%"$N;OE@!&=*E@$K$O!"(B127.0.0.1:2222 $B$,8=$l$J$$$H$$$&$3$H$G$9!#(B
$B$J$N$G!"(B2222/tcp $B$H(B 22/tcp $B$GBT$A<u$1$F$$$k(B 2 $B$D$N(B sshd $B$,%[%9%H(B B $B$K(B
$B$"$C$F!";OE@%"%I%l%9$r>r7o$K(B IPFW fwd $B$G?6$jJ,$1$?>l9g!"(B
$B30$+$i$O!"$I$A$i$b(B 22/tcp $B$K@\B3$7$F$$$k$h$&$K8+$($^$9!#(B
127.0.0.1:2222 $B$GBT$A<u$1$F$$$k$N$K!"(B192.168.11.3:22 $B$+$iDL?.$,(B
$B9T$J$o$l$F$$$k$h$&$KF0:n$9$k$N$O4qL/$JOC$N$h$&$K;W$($^$9$,!"(B
listen $B$7$F$$$k%"%I%l%9$H!"(Baccept $B$N;~$N=*E@%"%I%l%9$,(B
$B0[$J$C$F$$$k$H$$$&>uBV$O!"FCJL$J$b$N$G$O$"$j$^$;$s!#(B
$B$?$H$($P%G!<%b%s$,(B INADDR_ANY (0.0.0.0) $B$G(B listen $B$7$F$$$k>l9g!"(B
accept $B$7$F@8@.$5$l$kDL?.MQ(B socket $B$N%T%";OE@%"%I%l%9$O(B
$BEvA3$J$,$i(B 0.0.0.0 $B$G$O$J$/!"@\B3$7$F$-$?Aj<j$N%"%I%l%9$,;H$o$l$^$9!#(B
$B$=$l$H$^$C$?$/F1$8$G$9!#(B
Tetsuya Ito <chaltier@agate.plala.or.jp> wrote
in <20150331212326.2783.A7D5A726@agate.plala.or.jp>:
ch> $B7k2L$rE;$a$^$9$H!"(B
ch>
ch> add 1001 pass tcp from any to any established
ch> add 1002 fwd 127.0.0.1,2222 tcp from not <$BFCDj(BIP> to me 22
ch>
ch> $B"M(B $B@h$K(Bestablished$B$,$"$k>l9g$O(BNG (22/tcp$B$K@\B3$5$l$k(B)
ch>
ch> add 1001 fwd 127.0.0.1,2222 tcp from not <$BFCDj(BIP> to me 22
ch> add 1002 pass tcp from any to any established
ch>
ch> $B"M(B $BA[DjDL$jFCDj(BIP$B0J30$O(B2222/tcp$B$K@\B3$5$l$k!#(B
ch>
ch> $B$H$$$&7k2L$H$J$j$^$7$?!#(B
ch>
ch> $B$?$@!"%m!<%+%k%M%C%H$N@\B3$^$G5qH]$5$l$F$7$^$&$N$G!"$A$g$C$H:$$C$F$^$9!#(B
ch> $B%m!<%+%k%M%C%H@\B3$N(Bpass$B%k!<%k$r(Bfwd$B$NA0$K@_Dj$9$k$7$+$J$$$G$9$+$M(B...$B!#(B
established $B$,@h$K$"$k$H!"(BTCP $B$N:G=i$N%Q%1%C%H$@$1(B 127.0.0.1:2222 $B$K(B
$BE>Aw$5$l$F!"$=$l0J9_$O(B 192.168.11.3:22 $B$KAw$i$l$F$7$^$&$?$a!"(B
$BF0:n$7$J$$$N$@$H;W$$$^$9!#(B
$B%m!<%+%k%M%C%H$N@\B3$,5qH]$5$l$k!"$H$$$&$N$,6qBNE*$K(B
$B2?$r;X$7$F$$$k$N$+$,$h$/J,$+$i$J$$$N$G$9$,!"(B
$B$?$H$($P%[%9%H(B B $B>e$G(B "ssh 127.0.0.1" $B$H$d$C$?;~$K(B
22/tcp $B$G$O$J$/(B 2222/tcp $B$K@\B3$5$l$F$7$^$&$N$,:$$k$H$$$&OC$G$"$l$P!"(B
to me $B$G$O$J$/(B to 192.168.11.3 $B$H(B fwd $B$r8BDj$9$l$PNI$$$h$&$K;W$$$^$9!#(B
-- Hiroki
----Security_Multipart(Thu_Apr__2_05_31_32_2015_000)--
Content-Type: application/pgp-signature
Content-Transfer-Encoding: 7bit
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEABECAAYFAlUcVaQACgkQTyzT2CeTzy273ACbB4ghMx0inn4YT3y+DrzV+TIX
mUIAoJwo2h6aX+M6n3HJKQ7IBfcKitll
=Uvcz
-----END PGP SIGNATURE-----
----Security_Multipart(Thu_Apr__2_05_31_32_2015_000)----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20150402.053132.1512763590932251857.hrs>