irc

irc

[trainier]

Can anyone tell me how I can initiate an irc connection using iptables?

I'm using iptables version v1.2.3
Red Hat Linux 7.2 Kernel version 2.4.22

Regards,

Tim Rainier

Re: irc

[Antony Stone]

On Monday 17 November 2003 3:15 pm, trainier@kalsec.com wrote:

> Can anyone tell me how I can initiate an irc connection using iptables?

Suggest you initiate an IRC connection using an IRC client :)

Netfilter / iptables might be involved in forwarding the packets, but what's 
the problem?   I use IRC through a NAT firewall with nothing special for this 
particular protocol.

Antony.

-- 

Never write it in Perl if you can do it in Awk.
Never do it in Awk if sed can handle it.
Never use sed when tr can do the job.
Never invoke tr when cat is sufficient.
Avoid using cat whenever possible.
                                                     Please reply to the list;
                                                           please don't CC me.

Re: irc

[dan radom]

* trainier@kalsec.com (trainier@kalsec.com) wrote:
> Can anyone tell me how I can initiate an irc connection using iptables?
> 
> I'm using iptables version v1.2.3
> Red Hat Linux 7.2 Kernel version 2.4.22
> 

With an irc client!  My personal favorite is BitchX.

Re: irc

[trainier]

Aye, a familiar face. ;-)

The 'firewall' in this case, is a transparent proxy server.  The proxy 
server will be the gateway to the internet.
I need to allow irc connections through this machine, somehow.  I don't 
know how to do that.

Regards,

Tim Rainier





Antony Stone <Antony@Soft-Solutions.co.uk>
Sent by: netfilter-admin@lists.netfilter.org
11/17/2003 10:20 AM

 
        To:     netfilter@lists.netfilter.org
        cc: 
        Subject:        Re: irc


On Monday 17 November 2003 3:15 pm, trainier@kalsec.com wrote:

> Can anyone tell me how I can initiate an irc connection using iptables?

Suggest you initiate an IRC connection using an IRC client :)

Netfilter / iptables might be involved in forwarding the packets, but 
what's 
the problem?   I use IRC through a NAT firewall with nothing special for 
this 
particular protocol.

Antony.

-- 

Never write it in Perl if you can do it in Awk.
Never do it in Awk if sed can handle it.
Never use sed when tr can do the job.
Never invoke tr when cat is sufficient.
Avoid using cat whenever possible.
                                                     Please reply to the 
list;
                                                           please don't CC 
me.

Re: irc

[Jeffrey Laramie]

Antony Stone wrote:

>On Monday 17 November 2003 3:15 pm, trainier@kalsec.com wrote:
>
>  
>
>>Can anyone tell me how I can initiate an irc connection using iptables?
>>    
>>
>
>Suggest you initiate an IRC connection using an IRC client :)
>
>Netfilter / iptables might be involved in forwarding the packets, but what's 
>the problem?   I use IRC through a NAT firewall with nothing special for this 
>particular protocol.
>
>Antony.
>
>  
>
You type too fast! You've already had 2. I get the next one!

Jeff

Re: irc

[Antony Stone]

On Monday 17 November 2003 3:30 pm, trainier@kalsec.com wrote:

> Aye, a familiar face. ;-)

Good afternoon :)

> The 'firewall' in this case, is a transparent proxy server.  The proxy
> server will be the gateway to the internet.

Hm, well there's a problem there, because netfilter is not a proxy firewall - 
it's a stateful packet filter.

> I need to allow irc connections through this machine, somehow.  I don't
> know how to do that.

All I can suggest is that you look around for an IRC proxy server, however I 
have no knowledge of such things myself.

Regards,

Antony.

-- 

The only problem with the Universe as a platform, though, is that it is 
currently running someone else's program.

 - Ken Karakotsios, author of SimLife
                                                     Please reply to the list;
                                                           please don't CC me.

Re: irc

[Antony Stone]

On Monday 17 November 2003 3:33 pm, Jeffrey Laramie wrote:

> Antony Stone wrote:
> >On Monday 17 November 2003 3:15 pm, trainier@kalsec.com wrote:
> >>Can anyone tell me how I can initiate an irc connection using iptables?
> >
> >Suggest you initiate an IRC connection using an IRC client :)
> >
> >Netfilter / iptables might be involved in forwarding the packets, but
> > what's the problem?   I use IRC through a NAT firewall with nothing
> > special for this particular protocol.
> >
> >Antony.
>
> You type too fast! You've already had 2. I get the next one!

It's a deal :)

Antony.

-- 

In science, one tries to tell people
in such a way as to be understood by everyone
something that no-one ever knew before.

In poetry, it is the exact opposite.

 - Paul Dirac
                                                     Please reply to the list;
                                                           please don't CC me.

Re: irc

[dan radom]

* trainier@kalsec.com (trainier@kalsec.com) wrote:
> Aye, a familiar face. ;-)
> 
> The 'firewall' in this case, is a transparent proxy server.  The proxy 
> server will be the gateway to the internet.
> I need to allow irc connections through this machine, somehow.  I don't 
> know how to do that.
> 
> Regards,
> 
> Tim Rainier
> 

You can always just allow established and related packets back in.  This
should make almost any connection initiated from the LAN or iptables
machine work.

iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Re: irc

[Antony Stone]

On Monday 17 November 2003 3:41 pm, dan radom wrote:

> * trainier@kalsec.com (trainier@kalsec.com) wrote:
> > Aye, a familiar face. ;-)
> >
> > The 'firewall' in this case, is a transparent proxy server.  The proxy
> > server will be the gateway to the internet.
> > I need to allow irc connections through this machine, somehow.  I don't
> > know how to do that.
> >
> > Regards,
> >
> > Tim Rainier
>
> You can always just allow established and related packets back in.  This
> should make almost any connection initiated from the LAN or iptables
> machine work.
>
> iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Observations:

1. The above suggestion will allow the machine to act as a stateful packet 
filtering firewall (which netfilter is very good at), but not as a proxy 
firewall (which netfilter doesn't do).

2. The example rule, because it is in the INPUT chain, will only allow 
packets coming back to the firewall machine itself - the rule needs to be in 
the FORWARD chain if you want to allow packets back to a protected network on 
the 'inside' of the firewall.

3. In either case (INPUT or FORWARD) you also need rules to allow the initial 
connection out of the machine - this would be in either the OUTPUT or FORWARD 
chains, again depending on whether we're talking about the firewall itself, 
or a protected network.

Antony.

-- 

What a waste it is to lose one's mind -- or not to have a mind.   How true 
that is.

 - Dan Quayle, vice-president of the United States of America
                                                     Please reply to the list;
                                                           please don't CC me.

Re: irc

[SBlaze]

 > All I can suggest is that you look around for an IRC proxy server, however I

> have no knowledge of such things myself.
> 
> Regards,
> 
> Antony.
> 

There are such things as IRC Proxys. bnc is one of the more common ones that I
have heard of. However this won't do him any good since he is looking for a
rule to allow in IRC protocol. This is just an FYI email. :}}

SBlaze

=====
In the absence of order there will be chaos.

__________________________________
Do you Yahoo!?
Protect your identity with Yahoo! Mail AddressGuard
http://antispam.yahoo.com/whatsnewfree

Re: irc

[Antony Stone]

On Monday 17 November 2003 4:10 pm, SBlaze wrote:

>  > All I can suggest is that you look around for an IRC proxy server,
>  > however I have no knowledge of such things myself.
> >
> > Regards,
> >
> > Antony.
>
> There are such things as IRC Proxys. bnc is one of the more common ones
> that I have heard of. However this won't do him any good since he is
> looking for a rule to allow in IRC protocol.

I'm not sure that *is* what he's looking for?   Quoting from his second 
posting:

"The 'firewall' in this case, is a transparent proxy server.  The proxy 
server will be the gateway to the internet.   I need to allow irc connections 
through this machine, somehow.  I don't know how to do that."

Therefore it seems to me that he's looking for an IRC proxy server, not a 
packet filtering rule.

Maybe I'm just confused.

Antony.

-- 

This email was created using 100% recycled electrons.

                                                     Please reply to the list;
                                                           please don't CC me.

RE: irc

[bmcdowell]

At the risk of getting OT, what is the point of a proxy for IRC on a gateway?  I could see it as an anonymizer to bounce IRC off of, but on a gateway this would not seem to functionally any different than NAT.  What am I missing?

Bob

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Antony Stone
Sent: Monday, November 17, 2003 10:18 AM
To: netfilter@lists.netfilter.org
Subject: Re: irc


On Monday 17 November 2003 4:10 pm, SBlaze wrote:

>  > All I can suggest is that you look around for an IRC proxy server,
>  > however I have no knowledge of such things myself.
> >
> > Regards,
> >
> > Antony.
>
> There are such things as IRC Proxys. bnc is one of the more common ones
> that I have heard of. However this won't do him any good since he is
> looking for a rule to allow in IRC protocol.

I'm not sure that *is* what he's looking for?   Quoting from his second 
posting:

"The 'firewall' in this case, is a transparent proxy server.  The proxy 
server will be the gateway to the internet.   I need to allow irc connections 
through this machine, somehow.  I don't know how to do that."

Therefore it seems to me that he's looking for an IRC proxy server, not a 
packet filtering rule.

Maybe I'm just confused.

Antony.

-- 

This email was created using 100% recycled electrons.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: irc

[Jeffrey Laramie]

Antony Stone wrote:

>On Monday 17 November 2003 4:10 pm, SBlaze wrote:
>
>  
>
>> > All I can suggest is that you look around for an IRC proxy server,
>> > however I have no knowledge of such things myself.
>>    
>>
>>>Regards,
>>>
>>>Antony.
>>>      
>>>
>>There are such things as IRC Proxys. bnc is one of the more common ones
>>that I have heard of. However this won't do him any good since he is
>>looking for a rule to allow in IRC protocol.
>>    
>>
>
>I'm not sure that *is* what he's looking for?   Quoting from his second 
>posting:
>
>"The 'firewall' in this case, is a transparent proxy server.  The proxy 
>server will be the gateway to the internet.   I need to allow irc connections 
>through this machine, somehow.  I don't know how to do that."
>
>Therefore it seems to me that he's looking for an IRC proxy server, not a 
>packet filtering rule.
>
>Maybe I'm just confused.
>  
>
Say it ain't so!  :-)

Just out of curiosity, what exactly is the difference between an IRC 
server and an IRC proxy?

Client connects to server
Client connects to proxy

Server relays
Proxy relays

Hmmm.

Re: irc

[Antony Stone]

On Monday 17 November 2003 4:28 pm, bmcdowell@coxhealthplans.com wrote:

> At the risk of getting OT, what is the point of a proxy for IRC on a
> gateway?  I could see it as an anonymizer to bounce IRC off of, but on a
> gateway this would not seem to functionally any different than NAT.  What
> am I missing?

I don't think you're missing anything.   And whether an IRC proxy would 
anonymise connections depends on how the proxy was written, I think (an http 
proxy does not necessarily anonymise http connections, for example, and an 
smtp proxy (aka mail server) certainly doesn't).

I simply think packet filtering and application proxying are two approaches 
to building a firewall, and some people choose one, some people choose the 
other.   This list is mainly for people using the packet filtering method, 
but it doesn't mean it's the only way to do it.

Antony.

-- 

Software development can be quick, high-quality, or low-cost.

The customer gets to pick any two out of three.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: irc

[Antony Stone]

On Monday 17 November 2003 4:35 pm, Jeffrey Laramie wrote:

> Just out of curiosity, what exactly is the difference between an IRC
> server and an IRC proxy?
>
> Client connects to server
> Client connects to proxy
>
> Server relays
> Proxy relays
>
> Hmmm.

In that case I simply don't know enough about the IRC protocol (which is 
true).

It sounds like SMTP to me - there's no such thing as an SMTP proxy, because 
that is what an SMTP server is.   Perhaps this is the ideal answer to the 
original question :) ?

Antony.

-- 

It's vital to remember who you really are.   It's very important.   It isn't 
a good idea to rely on other people or things to do it for, you see.   They 
always get it wrong.

 - Terry Pratchett, Sourcery
                                                     Please reply to the list;
                                                           please don't CC me.

Re: irc

[trainier]

I'll attempt to clear things up a bit.

An irc proxy, is a machine that accepts a connection, then forwards you on 
to the proxy server.  An irc bounce, is very similiar in nature.
The general idea behind an irc proxy/bnc is that you have a way to 
anonymize yourself.  You have a way of allowing many people to connect to 
irc, from one address. (most irc servers don't allow more than 2 
connections from the same IP.  With a proxy and, what's called an i:line, 
they can allow proxied hosts if they're secure). 

What I'm looking for, is not an irc proxy.  I'm already connecting to an 
irc proxy.  The problem is, when I changed my default gateway to point at 
my http-proxy, I can no longer make connections out to my irc server.  (It 
comes back with a "connection refused").  I thought I would have to use 
NAT in this case, just like I have to use NAT to allow http and ftp 
requests, through the squid proxy server.
Here's how I'm set up:


Client machine ->   squid-proxy   ->  DMZ  ->  IRC Server.

When the client machine sends a connection request to the irc server, it 
comes back with a "Connection Refused".
I thought I could use some NAT/Netfiltering rules, to fix this issue.

Does any of this make sense, yet?  :-/

Regards,

Tim Rainier

Re: irc

[trainier]

Well.  heh
It's certainly more complicated than just a couple of netfilter/NAT rules.
I'm not sure if I need to run an irc proxy or not.

Tim




Antony Stone <Antony@Soft-Solutions.co.uk>
Sent by: netfilter-admin@lists.netfilter.org
11/17/2003 12:33 PM

 
        To:     netfilter@lists.netfilter.org
        cc: 
        Subject:        Re: irc


On Monday 17 November 2003 4:35 pm, Jeffrey Laramie wrote:

> Just out of curiosity, what exactly is the difference between an IRC
> server and an IRC proxy?
>
> Client connects to server
> Client connects to proxy
>
> Server relays
> Proxy relays
>
> Hmmm.

In that case I simply don't know enough about the IRC protocol (which is 
true).

It sounds like SMTP to me - there's no such thing as an SMTP proxy, 
because 
that is what an SMTP server is.   Perhaps this is the ideal answer to the 
original question :) ?

Antony.

-- 

It's vital to remember who you really are.   It's very important.   It 
isn't 
a good idea to rely on other people or things to do it for, you see. They 
always get it wrong.

 - Terry Pratchett, Sourcery
                                                     Please reply to the 
list;
                                                           please don't CC 
me.

Re: irc

[Jeffrey Laramie]

Antony Stone wrote:

>On Monday 17 November 2003 4:35 pm, Jeffrey Laramie wrote:
>
>  
>
>>Just out of curiosity, what exactly is the difference between an IRC
>>server and an IRC proxy?
>>
>>Client connects to server
>>Client connects to proxy
>>
>>Server relays
>>Proxy relays
>>
>>Hmmm.
>>    
>>
>
>In that case I simply don't know enough about the IRC protocol (which is 
>true).
>
>It sounds like SMTP to me - there's no such thing as an SMTP proxy, because 
>that is what an SMTP server is.   Perhaps this is the ideal answer to the 
>original question :) ?
>  
>

Functionally sticking an IRC server on the perimeter works, but then you 
have the work of securing and maintaining an IRC server which is no 
small task. Maybe SBlaze knows more about the proxy he mentioned and how 
it works. If your letting IRC (bots!) into your LAN you've got your 
hands full.

Jeff

Re: irc

[Antony Stone]

On Monday 17 November 2003 5:43 pm, trainier@kalsec.com wrote:

> I'll attempt to clear things up a bit.
>
> An irc proxy, is a machine that accepts a connection, then forwards you on
> to the proxy server.  An irc bounce, is very similiar in nature.

Ah, so there is a difference between an IRC proxy and an IRC server?   (I 
didn't know - I'm not familiar enough with the IRC protocol).

> What I'm looking for, is not an irc proxy.  I'm already connecting to an
> irc proxy.  The problem is, when I changed my default gateway to point at
> my http-proxy, I can no longer make connections out to my irc server.

That sort of makes sense.   Does your http proxy know how to forward non-http 
traffic (so the traffic can get to the IRC proxy, for example), and is it 
correctly forwarding such traffic?

> (It comes back with a "connection refused").

I'm puzzled about what "it" is in this sentence.   Which machine sends back a 
packet to your IRC client indicating that there's a problem?

> I thought I would have to use NAT in this case, just like I have to use NAT
> to allow http and ftp requests, through the squid proxy server.

Whether or not you need to use NAT depends on where your public & private IP 
addresses meet.   If the squid proxy is also your router joining the public 
to the private network, then yes, you will need NAT rules in order to get any 
non-http traffic through it.   If the 'other side' of your squid proxy is 
still privately addressed within your own network, and your public IP address 
router is somewhere beyond it, then you don't need to do NAT on the squid 
proxy, just normal routing table entries (and the machines on the other side 
need to know that this is a gateway back to the addresses on the inside of it 
of course).

> Here's how I'm set up:
>
> Client machine ->   squid-proxy   ->  DMZ  ->  IRC Server.

If you can add some IP addresses / network ranges to that diagram, and maybe 
include your Internet router in there as well, it would be helpful

Please note that I have chosen the sig below specifically for this email :)

Regards,

Antony.

-- 

90% of network problems are routing problems.
9 of the remaining 10% are routing problems in the other direction.
The remaining 1% might be something else, but check the routing anyway.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: irc

[trainier]

To clear the air,
I'm trying to connec to an irc server.  Not, clients are trying to connect 
to me.

Is that what everyone thought I was doing?

I'm simply just trying to connect to irc.  :-)

Regards,

Tim 

(and I apologize for all the confusion)




Jeffrey Laramie <JALaramie@Loudoun-Fairfax.com>
Sent by: netfilter-admin@lists.netfilter.org
11/17/2003 01:04 PM

 
        To:     netfilter@lists.netfilter.org
        cc: 
        Subject:        Re: irc


Antony Stone wrote:

>On Monday 17 November 2003 4:35 pm, Jeffrey Laramie wrote:
>
> 
>
>>Just out of curiosity, what exactly is the difference between an IRC
>>server and an IRC proxy?
>>
>>Client connects to server
>>Client connects to proxy
>>
>>Server relays
>>Proxy relays
>>
>>Hmmm.
>> 
>>
>
>In that case I simply don't know enough about the IRC protocol (which is 
>true).
>
>It sounds like SMTP to me - there's no such thing as an SMTP proxy, 
because 
>that is what an SMTP server is.   Perhaps this is the ideal answer to the 

>original question :) ?
> 
>

Functionally sticking an IRC server on the perimeter works, but then you 
have the work of securing and maintaining an IRC server which is no 
small task. Maybe SBlaze knows more about the proxy he mentioned and how 
it works. If your letting IRC (bots!) into your LAN you've got your 
hands full.

Jeff

Re: irc

[trainier]

Okay, here's the revised copy of my situation, with ip addresses:

Client machine (192.168.1.162) ->  (192.168.1.7)  squid-proxy 
(208.224.3.156)  ->  DMZ  (208.224.3.153) ->  (irc.blessed.net)  IRC Server.

I don't know what "IT" is.  That is what I need to find out (packet 
sniffer?).  I'm assuming it's the irc server.

I know how to set nat up in this situation.  I know it's what I need, but 
am not sure how to do it.





Antony Stone <Antony@Soft-Solutions.co.uk>
Sent by: netfilter-admin@lists.netfilter.org
11/17/2003 01:11 PM

 
        To:     netfilter@lists.netfilter.org
        cc: 
        Subject:        Re: irc


On Monday 17 November 2003 5:43 pm, trainier@kalsec.com wrote:

> I'll attempt to clear things up a bit.
>
> An irc proxy, is a machine that accepts a connection, then forwards you 
on
> to the proxy server.  An irc bounce, is very similiar in nature.

Ah, so there is a difference between an IRC proxy and an IRC server?   (I 
didn't know - I'm not familiar enough with the IRC protocol).

> What I'm looking for, is not an irc proxy.  I'm already connecting to an
> irc proxy.  The problem is, when I changed my default gateway to point 
at
> my http-proxy, I can no longer make connections out to my irc server.

That sort of makes sense.   Does your http proxy know how to forward 
non-http 
traffic (so the traffic can get to the IRC proxy, for example), and is it 
correctly forwarding such traffic?

> (It comes back with a "connection refused").

I'm puzzled about what "it" is in this sentence.   Which machine sends 
back a 
packet to your IRC client indicating that there's a problem?

> I thought I would have to use NAT in this case, just like I have to use 
NAT
> to allow http and ftp requests, through the squid proxy server.

Whether or not you need to use NAT depends on where your public & private 
IP 
addresses meet.   If the squid proxy is also your router joining the 
public 
to the private network, then yes, you will need NAT rules in order to get 
any 
non-http traffic through it.   If the 'other side' of your squid proxy is 
still privately addressed within your own network, and your public IP 
address 
router is somewhere beyond it, then you don't need to do NAT on the squid 
proxy, just normal routing table entries (and the machines on the other 
side 
need to know that this is a gateway back to the addresses on the inside of 
it 
of course).

> Here's how I'm set up:
>
> Client machine ->   squid-proxy   ->  DMZ  ->  IRC Server.

If you can add some IP addresses / network ranges to that diagram, and 
maybe 
include your Internet router in there as well, it would be helpful

Please note that I have chosen the sig below specifically for this email 
:)

Regards,

Antony.

-- 

90% of network problems are routing problems.
9 of the remaining 10% are routing problems in the other direction.
The remaining 1% might be something else, but check the routing anyway.

                                                     Please reply to the 
list;
                                                           please don't CC 
me.

Re: irc

[Antony Stone]

On Monday 17 November 2003 6:42 pm, trainier@kalsec.com wrote:

> Okay, here's the revised copy of my situation, with ip addresses:
>
> Client machine (192.168.1.162) ->  (192.168.1.7)  squid-proxy
> (208.224.3.156)  ->  DMZ  (208.224.3.153) ->  (irc.blessed.net)  IRC
> Server.

Right.   This looks to me like the squid proxy is also your router between 
the LAN and the Internet, therefore it needs standard NAT and FORWARDing 
rules to allow non-http traffic as well as the REDIRECT rule for diverting 
your http traffic to squid itself.

eg:

iptables -P FORWARD DROP
iptables -F FORWARD
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth1 -p udp --dport 53 -j ACCEPT
(if you're using an internal DNS server, add another rule like the one above 
but for TCP traffic on port 53 as well)
iptables -A FORWARD -i eth1 -p tcp --dport 6667 -j ACCEPT
(the above rules assume eth1 is your internal interface - change if needed)
iptables -A POSTROUTING -t nat -o eth0 -j SNAT --to 208.224.3.156
(the above rule assumes eth0 is your external interface - change if needed)

And, of course, make sure the box is forwarding packets:

echo 1 >/proc/sys/net/ipv4/ip_forward

If that doesn't do the trick start adding some LOGging lines above and/or 
below these rules and find out what traffic I've missed.

Regards,

Antony.

-- 

Windows: just another pane in the glass.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: irc

[Alistair Tonner]

On November 17, 2003 02:29 pm, Antony Stone wrote:
> On Monday 17 November 2003 6:42 pm, trainier@kalsec.com wrote:
> > Okay, here's the revised copy of my situation, with ip addresses:
> >
> > Client machine (192.168.1.162) ->  (192.168.1.7)  squid-proxy
> > (208.224.3.156)  ->  DMZ  (208.224.3.153) ->  (irc.blessed.net)  IRC
> > Server.
>
> Right.   This looks to me like the squid proxy is also your router between
> the LAN and the Internet, therefore it needs standard NAT and FORWARDing
> rules to allow non-http traffic as well as the REDIRECT rule for diverting
> your http traffic to squid itself.
>
> eg:
>
> iptables -P FORWARD DROP
> iptables -F FORWARD
> iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -A FORWARD -i eth1 -p udp --dport 53 -j ACCEPT
> (if you're using an internal DNS server, add another rule like the one
> above but for TCP traffic on port 53 as well)
> iptables -A FORWARD -i eth1 -p tcp --dport 6667 -j ACCEPT
> (the above rules assume eth1 is your internal interface - change if needed)
> iptables -A POSTROUTING -t nat -o eth0 -j SNAT --to 208.224.3.156
> (the above rule assumes eth0 is your external interface - change if needed)
>
> And, of course, make sure the box is forwarding packets:
>
> echo 1 >/proc/sys/net/ipv4/ip_forward
>
> If that doesn't do the trick start adding some LOGging lines above and/or
> below these rules and find out what traffic I've missed.
>
> Regards,
>
> Antony.

	If you've several systems that want to connect and do DCC you 
	will want to make sure you load the conntrack and nat irc 
	handlers from iptables ... they aren't needed for plain connections,
	but are for DCC sends/recieves.
	
	You might find that a lot of servers refuse to accept connections
	from the above setup:

	As a rule these days a LOT of irc servers want an identd reply ... 
	identd is a horrible security problem, but you can use several 
	alternatives ... I've a python script that acts as a chrooted identd 
	server -- works a charm replying with random numbers .... 
	(written by someone else ..... not me)
	An NO identifying info ... 
-- 

	Alistair Tonner
	nerdnet.ca
	Senior Systems Analyst - RSS
	
     Any sufficiently advanced technology will have the appearance of magic.
	Lets get magical!

Re: irc

[Antony Stone]

On Monday 17 November 2003 7:56 pm, Alistair Tonner wrote:

> 	If you've several systems that want to connect and do DCC you
> 	will want to make sure you load the conntrack and nat irc
> 	handlers from iptables ... they aren't needed for plain connections,
> 	but are for DCC sends/recieves.

Indeed, however I assumed that anyone interested in the security of having a 
firewall wouldn't be using insecure things like DCC.   However, your reminder 
that there is a conntrack helper for this protocol is a good one.

> 	As a rule these days a LOT of irc servers want an identd reply ...
> 	identd is a horrible security problem, but you can use several
> 	alternatives ... I've a python script that acts as a chrooted identd
> 	server -- works a charm replying with random numbers ....

You mean they actually require an identd response before allowing a 
connection (rather than just making it take a bit longer than usual)?

What's the point in that?   It adds nothing to security, adds very little to 
logging opportunities, and only interferes with people trying to keep their 
networks to themselves.

Ho Hum; it's a strange world on the Internet....

Antony.

-- 

The idea that Bill Gates appeared like a knight in shining armour
to lead all customers out of a mire of technological chaos
neatly ignores the fact that it was he who, by peddling
second-rate technology, led them into it in the first place.

 - Douglas Adams in The Guardian, August 25, 1995
                                                     Please reply to the list;
                                                           please don't CC me.

Re: irc

[trainier]

The ident thing is partially true.  EFnet (the network I use), does claim 
to require ident.  If you actually look though, it initiates the 
connection, before it sends out it's ident request. 

I am not concerned at all with dcc.  dcc was a huge mistake and should've 
never been implemented into irc. 
I am, however, interested in the nat irc handlers.  Where do I get them 
and how do I use them? What're they for?

Regards,

Tim




Antony Stone <Antony@Soft-Solutions.co.uk>
Sent by: netfilter-admin@lists.netfilter.org
11/17/2003 03:05 PM

 
        To:     netfilter@lists.netfilter.org
        cc: 
        Subject:        Re: irc


On Monday 17 November 2003 7:56 pm, Alistair Tonner wrote:

>                If you've several systems that want to connect and do DCC 
you
>                will want to make sure you load the conntrack and nat irc
>                handlers from iptables ... they aren't needed for plain 
connections,
>                but are for DCC sends/recieves.

Indeed, however I assumed that anyone interested in the security of having 
a 
firewall wouldn't be using insecure things like DCC.   However, your 
reminder 
that there is a conntrack helper for this protocol is a good one.

>                As a rule these days a LOT of irc servers want an identd 
reply ...
>                identd is a horrible security problem, but you can use 
several
>                alternatives ... I've a python script that acts as a 
chrooted identd
>                server -- works a charm replying with random numbers ....

You mean they actually require an identd response before allowing a 
connection (rather than just making it take a bit longer than usual)?

What's the point in that?   It adds nothing to security, adds very little 
to 
logging opportunities, and only interferes with people trying to keep 
their 
networks to themselves.

Ho Hum; it's a strange world on the Internet....

Antony.

-- 

The idea that Bill Gates appeared like a knight in shining armour
to lead all customers out of a mire of technological chaos
neatly ignores the fact that it was he who, by peddling
second-rate technology, led them into it in the first place.

 - Douglas Adams in The Guardian, August 25, 1995
                                                     Please reply to the 
list;
                                                           please don't CC 
me.

Re: irc

[Alistair Tonner]

On November 17, 2003 03:55 pm, trainier@kalsec.com wrote:
> The ident thing is partially true.  EFnet (the network I use), does claim
> to require ident.  If you actually look though, it initiates the
> connection, before it sends out it's ident request.

	At least two of the UnderNet servers deny connections without
	ident.... and several misconfigured private servers for ISPs do the 
	same ... *sigh* (leastways far as I've been able to track my 
	*cough* households usage....)

>
> I am not concerned at all with dcc.  dcc was a huge mistake and should've
> never been implemented into irc.
> I am, however, interested in the nat irc handlers.  Where do I get them
> and how do I use them? What're they for?
>
> Regards,
>
> Tim

	They facilitate the DCC connections... 
	I've never had problems with basic connections to IRC servers
	without the NAT handler .. .the iptables NATting and 
	ESTABLISHED,RELATED rules handle server connections 
	just fine.  DCC initiates  a *new* connection inside packets across
	 the initial connection: iptables irc modules can peek inside these
	packets and setup the connection to the other end of the DCC request
	 (thus Direct Client to Client), this connection is NOT to the server and 
	has to be tracked separately from the initial server connection.
	the ip_nat_irc and ip_conntrack_irc modules in iptables manage this
	rather well.... And apparently we've fixed the problem that was caused
	by some clients trying to outsmart NAT by using the outside ip at the 
	client in the most recent iptables release and POM.  (way to go developers)

	(if you had set your client to use the ip address that the IRC server saw,
	ip_nat_irc and ip_conntrack_irc would label DCC connections as 
	'forged dcc requests' since they already had the natted address in the
	packet ... instead of the unnatted address)

>
>
>
>
> Antony Stone <Antony@Soft-Solutions.co.uk>
> Sent by: netfilter-admin@lists.netfilter.org
> 11/17/2003 03:05 PM
>
>
>         To:     netfilter@lists.netfilter.org
>         cc:
>         Subject:        Re: irc
>
> On Monday 17 November 2003 7:56 pm, Alistair Tonner wrote:
> >                If you've several systems that want to connect and do DCC
>
> you
>
> >                will want to make sure you load the conntrack and nat irc
> >                handlers from iptables ... they aren't needed for plain
>
> connections,
>
> >                but are for DCC sends/recieves.
>
> Indeed, however I assumed that anyone interested in the security of having
> a
> firewall wouldn't be using insecure things like DCC.   However, your
> reminder
> that there is a conntrack helper for this protocol is a good one.
>
> >                As a rule these days a LOT of irc servers want an identd
>
> reply ...
>
> >                identd is a horrible security problem, but you can use
>
> several
>
> >                alternatives ... I've a python script that acts as a
>
> chrooted identd
>
> >                server -- works a charm replying with random numbers ....
>
> You mean they actually require an identd response before allowing a
> connection (rather than just making it take a bit longer than usual)?
>
> What's the point in that?   It adds nothing to security, adds very little
> to
> logging opportunities, and only interferes with people trying to keep
> their
> networks to themselves.
>
> Ho Hum; it's a strange world on the Internet....
>
	Indeeeeeeeed it is..... *cough* wintendo *cough* skiddies included.
	(sorry ... i'm sitebanning a bunch of morons from a mush right now.)


> Antony.

-- 

	Alistair Tonner
	nerdnet.ca
	Senior Systems Analyst - RSS
	
     Any sufficiently advanced technology will have the appearance of magic.
	Lets get magical!

irc

[Yoshinori K. Okuji]

We are talking mostly in IRC now (#grub at irc.gnu.org), because the 
mail system has almost stopped. But I prefer the mailing list actually, 
since it supports archiving and MUA is normally better than IRC 
clients. If this mail is delivered smoothly, I will use this mailing 
list mainly.

Okuji

Re: irc

[Sergey Matveychuk]

Yoshinori K. Okuji wrote:
> We are talking mostly in IRC now (#grub at irc.gnu.org), because the 
> mail system has almost stopped. But I prefer the mailing list actually, 
> since it supports archiving and MUA is normally better than IRC 
> clients. If this mail is delivered smoothly, I will use this mailing 
> list mainly.

I'll be there some day. I use nick Sem_gnu there.

-- 
Sem.

irc

[Jody Belka]

Hi,

If anyone is interested, i've registered #xen-users and #xen-devel on
freenode, so pop by if you feel like it.


J

-- 
Jody Belka
knew (at) pimb (dot) org

Re: irc

[Rik van Riel]

On Wed, 30 Mar 2005, Jody Belka wrote:

> If anyone is interested, i've registered #xen-users and #xen-devel on
> freenode, so pop by if you feel like it.

Oh, we've been hanging out on #xen on OFTC for the last
weeks ;)

-- 
"Debugging is twice as hard as writing the code in the first place.
Therefore, if you write the code as cleverly as possible, you are,
by definition, not smart enough to debug it." - Brian W. Kernighan

IRC

[Charles Coffing]

On the Developer Discussion wiki page, it mentions the #xen channel on irc.oftc.net.  I haven't been able to connect to that server at all.  Is this really the correct server?

Thanks.

Re: IRC

[Mark Williamson]

> On the Developer Discussion wiki page, it mentions the #xen channel on
> irc.oftc.net.  I haven't been able to connect to that server at all.  Is
> this really the correct server?

Looks OK.  Occasionally I fail to connect but mostly it works fine.  Can you 
ping it?  What happens if you telnet to port 6667?

Cheers,
Mark

IRC

[Harald Hoyer]

how about meeting on IRC irc.freenode.net #dracut
--
To unsubscribe from this list: send the line "unsubscribe initramfs" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

IRC

[Nishanth Menon]

Hi Folks,

Just letting the list know that we have a registered channel on
irc.libera.chat (https://libera.chat) #linux-ti

If folks are interested in chatting away the old IRC style.


-- 
Regards,
Nishanth Menon
Key (0xDDB5849D1736249D) / Fingerprint: F8A2 8693 54EB 8232 17A3  1A34 DDB5 849D 1736 249D

Re: IRC

[Luca Ceresoli]

Hi Nishanth,

On 20/05/21 19:09, Nishanth Menon wrote:
> Hi Folks,
> 
> Just letting the list know that we have a registered channel on
> irc.libera.chat (https://libera.chat) #linux-ti

How does it differ from #linux-omap on freenode? Which one should people
use?

-- 
Luca

IRC

[Julia Lawall]

Hello,

The kernel-outreachy channel listed in the welcome message is out of date.
You can join the ##kernel-outreachy channel on libera.chat.  If you are
not familiar with IRC, you can try Libera's web chat:

https://libera.chat/guides/webchat

There are various IRC clients available:

https://libera.chat/guides/clients

julia