SNAT matching question

SNAT matching question

[Mohan Khurana]

Hi everyone,

I'm trying to make a dual-homed router right now.

I'm wondering, if I add two SNAT entries to the POSTROUTING chain of the
nat table, that are completely identical except the the fact that they
have different values for their specification of --to-source, will both of
them get the opportunity to match?  What decides which one matches them?

I am wondering, if packets come in, and I route them, and ensure that
their next-hop is one of the --to-sources, will the rule check both the
source range, and the value of the --to-source?

Example:

iptables -t nat -A POSTROUTING -s 192.168.2.10 -d \! 192.168.2.0/24 -j
SNAT --to-source 1.2.3.4
iptables -t nat -A POSTROUTING -s 192.168.2.10 -d \! 192.168.2.0/24 -j
SNAT --to-source 5.6.7.8

If in my iproute2 configuration, if I ensure that the packet is going out
with source 5.6.7.8 when flowing around, it should match to the second
rule, and skip the first altogether, right?  If I set it to hop to source
1.2.3.4, it should choose the first nat rule, and then skip the second one
altogether, right?

thanks much,

mohan

Re: SNAT matching question

[Antony Stone]

On Sunday 29 September 2002 2:30 pm, Mohan Khurana wrote:

> Hi everyone,
>
> I'm trying to make a dual-homed router right now.
>
> I'm wondering, if I add two SNAT entries to the POSTROUTING chain of the
> nat table, that are completely identical except the the fact that they
> have different values for their specification of --to-source, will both of
> them get the opportunity to match?  What decides which one matches them?

Well, yes, they will both get the *opportunity* to match (ie every packet 
will get tested against both rules), however depending on how you qualify the 
rules (specifically, whether you check the source address), the second one 
may not match because the first one has already changed the address.

> I am wondering, if packets come in, and I route them, and ensure that
> their next-hop is one of the --to-sources, will the rule check both the
> source range, and the value of the --to-source?

I don't understand.   Why would you set the *source* address of a packet to 
be the address of the next-hop router you're just about to send it on to ?   
Where are you expecting a reply to come back to ?

> Example:
>
> iptables -t nat -A POSTROUTING -s 192.168.2.10 -d \! 192.168.2.0/24 -j
> SNAT --to-source 1.2.3.4

This rule will match all packets with a source address = 192.168.2.10 which 
are not going to the network 192.168.2.0/24 (if they were, why would they be 
going through this firewall anyway ?   They'd just get sent straight across 
the local network...) and will change the source address to 1.2.3.4

> iptables -t nat -A POSTROUTING -s 192.168.2.10 -d \! 192.168.2.0/24 -j
> SNAT --to-source 5.6.7.8

This rule will try to match all packets with a source address = 192.168.2.10 
which are not going to the network 192.168.2.0/24 but there will never be 
any, because they've all just been changed to have a source address = 1.2.3.4

> If in my iproute2 configuration, if I ensure that the packet is going out
> with source 5.6.7.8 when flowing around, it should match to the second
> rule, and skip the first altogether, right?  If I set it to hop to source
> 1.2.3.4, it should choose the first nat rule, and then skip the second one
> altogether, right?

I don't understand what you're saying here, and I'm not sure I understand 
what you're trying to do.

Perhaps you could explain your network setup a bit more, and explain what 
you're trying to achieve, and we can comment on whether this seems like a 
reasonable way to achieve it.....

Antony.

-- 

I vote "no" to this proposal to form a committee to investigate whether we 
should or should not hold a ballot on whether to vote yet.

Re: SNAT matching question

[Mohan Khurana]

I'm trying to use the equalize nexthop iproute2 command with netfilter in
order to load balance between two ISPs on this router.  Equalize gives me
different gateway IPs on route determination.  The problem is, if I have
two different ISPs, I think I want something in the NAT table that would
determine which gateway the packet was going out of in order to match it
to the right --to-source address.

Let's say for example that I have something like:

ip route default table 1 equalize
		nexthop via 1.2.3.4 dev eth0
		nexthop via 5.6.7.8 dev eth1

This will give me a gateway of 1.2.3.4 in some cases, and 5.6.7.8 in some
cases (from that I understand, it dishes our the gateway in a round-robin
sort of manner, no?).  Now, if it selected 1.2.3.4 as the gateway, I'd
want it to NAT (if necessary) on 1.2.3.4, otherwise, if it selected
5.6.7.8, I'd want it to NAT on 5.6.7.8.  Does this make sense?

seeking wisdom,

mohan

On Sun, 29 Sep 2002, Antony Stone wrote:

> On Sunday 29 September 2002 2:30 pm, Mohan Khurana wrote:
>
> > Hi everyone,
> >
> > I'm trying to make a dual-homed router right now.
> >
> > I'm wondering, if I add two SNAT entries to the POSTROUTING chain of the
> > nat table, that are completely identical except the the fact that they
> > have different values for their specification of --to-source, will both of
> > them get the opportunity to match?  What decides which one matches them?
>
> Well, yes, they will both get the *opportunity* to match (ie every packet
> will get tested against both rules), however depending on how you qualify the
> rules (specifically, whether you check the source address), the second one
> may not match because the first one has already changed the address.
>
> > I am wondering, if packets come in, and I route them, and ensure that
> > their next-hop is one of the --to-sources, will the rule check both the
> > source range, and the value of the --to-source?
>
> I don't understand.   Why would you set the *source* address of a packet to
> be the address of the next-hop router you're just about to send it on to ?
> Where are you expecting a reply to come back to ?
>
> > Example:
> >
> > iptables -t nat -A POSTROUTING -s 192.168.2.10 -d \! 192.168.2.0/24 -j
> > SNAT --to-source 1.2.3.4
>
> This rule will match all packets with a source address = 192.168.2.10 which
> are not going to the network 192.168.2.0/24 (if they were, why would they be
> going through this firewall anyway ?   They'd just get sent straight across
> the local network...) and will change the source address to 1.2.3.4
>
> > iptables -t nat -A POSTROUTING -s 192.168.2.10 -d \! 192.168.2.0/24 -j
> > SNAT --to-source 5.6.7.8
>
> This rule will try to match all packets with a source address = 192.168.2.10
> which are not going to the network 192.168.2.0/24 but there will never be
> any, because they've all just been changed to have a source address = 1.2.3.4
>
> > If in my iproute2 configuration, if I ensure that the packet is going out
> > with source 5.6.7.8 when flowing around, it should match to the second
> > rule, and skip the first altogether, right?  If I set it to hop to source
> > 1.2.3.4, it should choose the first nat rule, and then skip the second one
> > altogether, right?
>
> I don't understand what you're saying here, and I'm not sure I understand
> what you're trying to do.
>
> Perhaps you could explain your network setup a bit more, and explain what
> you're trying to achieve, and we can comment on whether this seems like a
> reasonable way to achieve it.....
>
> Antony.
>
> --
>
> I vote "no" to this proposal to form a committee to investigate whether we
> should or should not hold a ballot on whether to vote yet.
>
>
>

Re: SNAT matching question

[Antony Stone]

On Sunday 29 September 2002 3:15 pm, Mohan Khurana wrote:

> I'm trying to use the equalize nexthop iproute2 command with netfilter in
> order to load balance between two ISPs on this router.  Equalize gives me
> different gateway IPs on route determination.  The problem is, if I have
> two different ISPs, I think I want something in the NAT table that would
> determine which gateway the packet was going out of in order to match it
> to the right --to-source address.

Okay - I understand why you want to change the source address now, however I 
think you're attempting to set it to the wrong value.   If you set the source 
address of a packet to be the next hop router you're just about to send it 
to, then the reply will get back to that router and no further.

I assume your network setup is something like this:

Internet
    |
ISP no. 1
    |
Router 1
    |
Public IP 1
   eth0
Netfilter box eth2 ------- Local network with private addresses
   eth1
Public IP2
    |
Router 2
    |
ISP no 2
    |
Internet

You need to SNAT to Public IP 1 if you're sending via ISP 1, and Public IP 2 
if you're sending via ISP 2.

Therefore I suggest you use the following rules in your POSTROUTING chain:

iptables -A POSTROUTING -t nat -o eth0 -j SNAT --to $pubIP1
iptables -A POSTROUTING -t nat -o eth1 -j SNAT --to $pubIP2

(Note that PubIP1 is not 1.2.3.4 - that address is on router 1.   Similarly 
PubIP2 is not 5.6.7.8 - that address is on router 2.)

Then when the replies come back in again (they will come through the same ISP 
as the outbound packet left, because that's the way PubIP1 and PubIP2 are 
routed), they will reach the netfilter box, which can do the reverse NAT, and 
send the packets on to the original source somewhere inside your LAN.

Just don't ask about how to do this for incoming connections (ie servers on 
your network instead of clients).

Antony.

-- 

It is also possible that putting the birds in a laboratory setting
inadvertently renders them relatively incompetent.

 - Daniel C Dennett

Re: SNAT matching question

[Mohan Khurana]

Incoming connections does pose a problem.  So I assume that the problem is
that a packet comes in to a locally hosted server, this is no problem.
The problem occurs when packets are flowing back out, since they may go
over the wrong interface due to the equalize nexthop.

right?

thanks again for your help,
mohan

On Sun, 29 Sep 2002, Antony Stone wrote:

> iptables -A POSTROUTING -t nat -o eth0 -j SNAT --to $pubIP1
> iptables -A POSTROUTING -t nat -o eth1 -j SNAT --to $pubIP2
>
> (Note that PubIP1 is not 1.2.3.4 - that address is on router 1.   Similarly
> PubIP2 is not 5.6.7.8 - that address is on router 2.)
>
> Then when the replies come back in again (they will come through the same ISP
> as the outbound packet left, because that's the way PubIP1 and PubIP2 are
> routed), they will reach the netfilter box, which can do the reverse NAT, and
> send the packets on to the original source somewhere inside your LAN.
>
> Just don't ask about how to do this for incoming connections (ie servers on
> your network instead of clients).
>
> Antony.
>
> --
>
> It is also possible that putting the birds in a laboratory setting
> inadvertently renders them relatively incompetent.
>
>  - Daniel C Dennett
>
>
>

Re: SNAT matching question

[Antony Stone]

On Sunday 29 September 2002 5:26 pm, Mohan Khurana wrote:

> Incoming connections does pose a problem.  So I assume that the problem is
> that a packet comes in to a locally hosted server, this is no problem.
> The problem occurs when packets are flowing back out, since they may go
> over the wrong interface due to the equalize nexthop.
>
> right?

No - I meant that there's no sensible way of balancing incoming connections 
because you have no control over the routing of packets out on the Internet 
which are coming to you.

Reply packets should not be a problem unless your ISPs block packets with 
source addresses which don't match the network range you have from them.

The packets themselves will get reverse NATted automagically by netfilter in 
the same way as the incoming packets.  No worries there.

Antony.

-- 

If the human brain were so simple that we could understand it,
we'd be so simple that we couldn't.

Re: SNAT matching question

[Mohan Khurana]

On Sun, 29 Sep 2002, Antony Stone wrote:

> No - I meant that there's no sensible way of balancing incoming connections
> because you have no control over the routing of packets out on the Internet
> which are coming to you.

Hmmm, this is true.

> Reply packets should not be a problem unless your ISPs block packets with
> source addresses which don't match the network range you have from them.

This is also true, but what if they do block?  I was hoping there was a
way to maintain connection tracking such that if there is a machine on the
internet that connects to an internally hosted server, it would maintain
the incoming gateway and interface, and then ensure that the equalize
command would ensure that the outgoing packet going to the right gateway.

ip route default table 1 equalize
	nexthop via 1.2.3.4
	nexthop via 5.6.7.8

Lets say some internet machine contact my webserver, which happens to be
at 1.2.3.33.  It would come in on 1.2.3.4.  Now the webserver needs to
send IP packets back out to the internet, so it does a routing table
lookup.  Because ISP1 would block ISP2 traffic and vice-versa, if the
selected gateway (as a result of the equalize statement above) is 5.6.7.8,
then the only way to get that IP packet out would be to NAT it on an IP
from ISP2.  Post-NAT, this would change the source field of the IP packet,
and break communication (the machine on the internet wanted a source of
1.2.3.33).

I think the solution is for incoming packets destined to servers marked as
state NEW to have their gateway and source address placed in a table.
When 1.2.3.33 wants to go out, the equalize flag should look up the table,
see if the destination host is in there, and if it is, it should return
the proper corresponding gateway.

What do you think?  Is this possible?

mohan

Re: SNAT matching question

[Antony Stone]

On Sunday 29 September 2002 6:09 pm, Mohan Khurana wrote:

> On Sun, 29 Sep 2002, Antony Stone wrote:

> > Reply packets should not be a problem unless your ISPs block packets with
> > source addresses which don't match the network range you have from them.
>
> This is also true, but what if they do block?  I was hoping there was a
> way to maintain connection tracking such that if there is a machine on the
> internet that connects to an internally hosted server, it would maintain
> the incoming gateway and interface, and then ensure that the equalize
> command would ensure that the outgoing packet going to the right gateway.

I do not know enough about equalise-routing to know how to do this.

> Lets say some internet machine contact my webserver, which happens to be
> at 1.2.3.33.  It would come in on 1.2.3.4.  Now the webserver needs to
> send IP packets back out to the internet, so it does a routing table
> lookup.  Because ISP1 would block ISP2 traffic and vice-versa, if the
> selected gateway (as a result of the equalize statement above) is 5.6.7.8,
> then the only way to get that IP packet out would be to NAT it on an IP
> from ISP2.  Post-NAT, this would change the source field of the IP packet,
> and break communication (the machine on the internet wanted a source of
> 1.2.3.33).

Correct.   If that happened, the communication would break.

> I think the solution is for incoming packets destined to servers marked as
> state NEW to have their gateway and source address placed in a table.
> When 1.2.3.33 wants to go out, the equalize flag should look up the table,
> see if the destination host is in there, and if it is, it should return
> the proper corresponding gateway.

If you can implement such a table then yes I agree this system should work.

There is an alternative, and that is to run your web server with two private 
IP addresses, and have the public address from ISP 1 translate to private IP 
1, and the public address from ISP 2 translate to private IP 2.   The web 
server is configured to provide precisely the same content for either IP 
address.

If you do that, then the web server will reply from the same source address 
as the original request used for its destination address, and you can use 
source-based routing in iproute2 to make sure that replies from private IP 1 
always go via ISP 1, and replies from private IP 2 always go via ISP 2.

Antony.

-- 

Normal people think "if it ain't broke, don't fix it".
Engineers think "if it ain't broke, it doesn't have enough features yet".

Re: SNAT matching question

[Mitesh P Choksi]

I have tried and tested this alternative of 2 private IP addresses and it
works brilliant in conjunction with iproute2.

Mitesh

Antony Stone said:
> On Sunday 29 September 2002 6:09 pm, Mohan Khurana wrote:
>
>> On Sun, 29 Sep 2002, Antony Stone wrote:
>
>> > Reply packets should not be a problem unless your ISPs block packets
>> > with source addresses which don't match the network range you have
>> > from them.
>>
>> This is also true, but what if they do block?  I was hoping there was
>> a way to maintain connection tracking such that if there is a machine
>> on the internet that connects to an internally hosted server, it would
>> maintain the incoming gateway and interface, and then ensure that the
>> equalize command would ensure that the outgoing packet going to the
>> right gateway.
>
> I do not know enough about equalise-routing to know how to do this.
>
>> Lets say some internet machine contact my webserver, which happens to
>> be at 1.2.3.33.  It would come in on 1.2.3.4.  Now the webserver needs
>> to send IP packets back out to the internet, so it does a routing
>> table lookup.  Because ISP1 would block ISP2 traffic and vice-versa,
>> if the selected gateway (as a result of the equalize statement above)
>> is 5.6.7.8, then the only way to get that IP packet out would be to
>> NAT it on an IP from ISP2.  Post-NAT, this would change the source
>> field of the IP packet, and break communication (the machine on the
>> internet wanted a source of 1.2.3.33).
>
> Correct.   If that happened, the communication would break.
>
>> I think the solution is for incoming packets destined to servers
>> marked as state NEW to have their gateway and source address placed in
>> a table. When 1.2.3.33 wants to go out, the equalize flag should look
>> up the table, see if the destination host is in there, and if it is,
>> it should return the proper corresponding gateway.
>
> If you can implement such a table then yes I agree this system should
> work.
>
> There is an alternative, and that is to run your web server with two
> private  IP addresses, and have the public address from ISP 1 translate
> to private IP  1, and the public address from ISP 2 translate to
> private IP 2.   The web  server is configured to provide precisely the
> same content for either IP  address.
>
> If you do that, then the web server will reply from the same source
> address  as the original request used for its destination address, and
> you can use  source-based routing in iproute2 to make sure that replies
> from private IP 1  always go via ISP 1, and replies from private IP 2
> always go via ISP 2.
>
> Antony.
>
> --
>
> Normal people think "if it ain't broke, don't fix it".
> Engineers think "if it ain't broke, it doesn't have enough features
> yet".




Regards,

Cyberdude Murli
The Earth

Nobody can help me ??? :(

[Hanz F.]

HI
I've posted an email asking for help, but got no
answer !! Isn't this mailing list usefull for new
members or what ??
All I need is to run all kind of softwares (IRC, ICQ,
yahoo messenger ,.....) through Netfilter , isn't that
possible ???
Thanks to whom will answer me.

Hanz



=============
There's three kind of people: people who can count and
people who can't count.



__________________________________________________
Do you Yahoo!?
New DSL Internet Access from SBC & Yahoo!
http://sbc.yahoo.com

Re: Nobody can help me ??? :(

[Nick]

# iptables -m state --help



On Monday 30 September 2002 03:27 pm, Hanz F. wrote:
> HI
> I've posted an email asking for help, but got no
> answer !! Isn't this mailing list usefull for new
> members or what ??
> All I need is to run all kind of softwares (IRC, ICQ,
> yahoo messenger ,.....) through Netfilter , isn't that
> possible ???
> Thanks to whom will answer me.
>
> Hanz
>
>
>
> =============
> There's three kind of people: people who can count and
> people who can't count.
>
>
>
> __________________________________________________
> Do you Yahoo!?
> New DSL Internet Access from SBC & Yahoo!
> http://sbc.yahoo.com

Re: Nobody can help me ??? :(

[Gaël Le Mignot]

Mon, 30 Sep 2002 01:27:25 -0700 (PDT), tu as dit : 

 > HI
 > I've posted an email asking for help, but got no
 > answer !! Isn't this mailing list usefull for new
 > members or what ??
 > All I need is to run all kind of softwares (IRC, ICQ,
 > yahoo messenger ,.....) through Netfilter , isn't that
 > possible ???

for IRC, you can use the IRC protocol helper (modprobe ip_conntrack_irc and
modprobe ip_nat_irc if you do NAT too).

For others, you'll have to find a protocol helper, which is not included
in the "standard" kernels (I'm not even sure they exist).

But I use ICQ through a netfilter-powered gateway that does NAT and 
firewalling, and it seems to work

-- 
Gael Le Mignot "Kilobug" - kilobug@freesurf.fr - http://kilobug.free.fr
GSM         : 06.71.47.18.22 (in France)   ICQ UIN   : 7299959
Fingerprint : 1F2C 9804 7505 79DF 95E6 7323 B66B F67B 7103 C5DA

Member of HurdFr: http://hurdfr.org - The GNU Hurd: http://hurd.gnu.org

Re: Nobody can help me ??? :(

[Michael]

Hanz F. wrote:

>HI
>I've posted an email asking for help, but got no
>answer !! Isn't this mailing list usefull for new
>members or what ??
>All I need is to run all kind of softwares (IRC, ICQ,
>yahoo messenger ,.....) through Netfilter , isn't that
>possible ???
>Thanks to whom will answer me.
>
Possible modules to load : 


modprobe ip_conntrack_ftp
modprobe ip_conntrack_irc
modprobe ip_nat_ftp
modprobe ip_nat_irc

I suggest you go look for IPtables Howtoo as this stuff is covered there 
somewhere. A good book might help too.

Some applications may not work without effort, and some may never 
work...Some applications need setting up from client end to work through 
firewall.

In all cases, since you are in control, you need to investigate what is 
needed (Ports, protocols supported by applications etc).

Another way to do it is to search for some firewalls already setup 
(sourceforge has some projects..) and use that. But always test the 
firewalls first...

Cheers,
Michael

RE: Nobody can help me ??? :(

[Hanz F.]

Hi,
thanx Ferry for ur answer, I like long and detailed
answers. U look to be a smart guy, but u forget a
reason, which is: that no one has the answer !!  ;-)
I say this becoze any of the reasons u mentioned can
apply to my case, anyway if u looked to my 1st email
b4 answering u could save some of the time u spent
writing this answer.
1- in fact if there was any smell of whiners it could
be in my 2nd email but definetely not in the 1st. And
the 2nd was answered !!!
2- If there was insufficient information I could be
asked to provide more information (as u can see
frequently if u look into the archive)
3,4- I could be told if there was no effort from my
part to solve it, or if I was impolite I don't think
that all people accept that someone talk to them in an
impolite way without reacting.
A look to archive as well shows that there's some
questions answered although they are very evident, and
anyone who makes a small effort can get the answer.
5- it's simple to know that my question wasn't
answered in the archive if u looked into it.
6- My 2nd email was posted to be sure that the 1st
email wasn't ignored becoze everyone was busy at the
moment. Notice that some emails posted just b4 and
after it have been answered.

finally, I would say that if I used this mailing list
it was becoze I couldn't get my answer by any other
mean !!
Anyway I am not here to argue with anyone, I just want
to get an answer to my question becoze I prefer to use
the Linux system, but unfortunately there's no serious
support for it which encourage people to use the buggy
Microsoft Windows and related products !!

Best regards




====================
People are divided into two kinds: a kind who thinks
people are divided into two kinds and a kind who don't



--- Ferry van Steen <ferry.van.steen@InfoPart.nl>
wrote:
> There are several reasons your question doesn't get
> answered.
> 
> 1. You whine, people don't like whiners (I'm not
> saying you are :-))
> 2. Insufficient information was provided (Again, I'm
> not saying you did)
> 3. It was clear there was no effort from your part
> to solve it, we're not
> here to do your work (ok I hate repeating this, this
> is a general list, I
> didn't see your first post so let's just call this
> the general answers to
> your question)
> 4. You were impolite/rude in which case you can
> stuff the question and all
> future ones there where the sun don't shine
> 5. You asked a question that gets asked over and
> over and people tire from
> answering it, look in the archives/faq to prevent
> this. Generally you will
> be labeled like 1 or 3 above in which case future
> questions get less
> attention as well.
> 6. Perhaps just everyone was busy at the moment.
> Remember, nobody gets paid
> here it's all voluntary. You could have asked at a
> moment everyone was
> really busy and just hit delete. Monday mornings are
> moments like these.
> 
> Please remember I didn't see your first post and
> thus dunno which of the
> above apply to you. I'm not trying to offend/flame
> you. 
> 
> -----Original Message-----
> From: Hanz F. [mailto:hanz852@yahoo.com] 
> Sent: maandag 30 september 2002 10:27
> To: netfilter@lists.netfilter.org
> Subject: Nobody can help me ??? :(
> 
> 
> HI
> I've posted an email asking for help, but got no
> answer !! Isn't this mailing list usefull for new
> members or what ??
> All I need is to run all kind of softwares (IRC,
> ICQ,
> yahoo messenger ,.....) through Netfilter , isn't
> that
> possible ???
> Thanks to whom will answer me.
> 
> Hanz
> 
> 
> 
> =============
> There's three kind of people: people who can count
> and
> people who can't count.
> 
> 
> 
> __________________________________________________
> Do you Yahoo!?
> New DSL Internet Access from SBC & Yahoo!
> http://sbc.yahoo.com
> 


__________________________________________________
Do you Yahoo!?
New DSL Internet Access from SBC & Yahoo!
http://sbc.yahoo.com

Re: Nobody can help me ??? :(

[Hanz F.]

Thanx Gael for your useful answer, and thanx for those
who tried to help.
But what is this "netfilter-powered gateway that does
NAT and firewalling" u are using ? and where to find
it ?
Thank u very much
Best regards 
Hanz




=============
There's three kind of people: people who can count and
people who can't count.


--- Gaël Le Mignot <kilobug@freesurf.fr> wrote:
> 
> Mon, 30 Sep 2002 01:27:25 -0700 (PDT), tu as dit : 
> 
>  > HI
>  > I've posted an email asking for help, but got no
>  > answer !! Isn't this mailing list usefull for new
>  > members or what ??
>  > All I need is to run all kind of softwares (IRC,
> ICQ,
>  > yahoo messenger ,.....) through Netfilter , isn't
> that
>  > possible ???
> 
> for IRC, you can use the IRC protocol helper
> (modprobe ip_conntrack_irc and
> modprobe ip_nat_irc if you do NAT too).
> 
> For others, you'll have to find a protocol helper,
> which is not included
> in the "standard" kernels (I'm not even sure they
> exist).
> 
> But I use ICQ through a netfilter-powered gateway
> that does NAT and 
> firewalling, and it seems to work
> 
> -- 
> Gael Le Mignot "Kilobug" - kilobug@freesurf.fr -
> http://kilobug.free.fr
> GSM         : 06.71.47.18.22 (in France)   ICQ UIN  
> : 7299959
> Fingerprint : 1F2C 9804 7505 79DF 95E6 7323 B66B
> F67B 7103 C5DA
> 
> Member of HurdFr: http://hurdfr.org - The GNU Hurd:
> http://hurd.gnu.org
> 


__________________________________________________
Do you Yahoo!?
New DSL Internet Access from SBC & Yahoo!
http://sbc.yahoo.com

Re: Nobody can help me ??? :(

[Gaël Le Mignot]

Mon, 30 Sep 2002 08:01:38 -0700 (PDT), tu as dit : 

 > Thanx Gael for your useful answer, and thanx for those
 > who tried to help.

:)

 > But what is this "netfilter-powered gateway that does
 > NAT and firewalling" u are using ? and where to find
 > it ?

Just an old PII-400 running a debian woody and using netfilter to share
an ADSL connection for the other computers of the house... (and doing some
firewalling too, to protect them).

bye
-- 
Gael Le Mignot "Kilobug" - kilobug@freesurf.fr - http://kilobug.free.fr
GSM         : 06.71.47.18.22 (in France)   ICQ UIN   : 7299959
Fingerprint : 1F2C 9804 7505 79DF 95E6 7323 B66B F67B 7103 C5DA

Member of HurdFr: http://hurdfr.org - The GNU Hurd: http://hurd.gnu.org