[SLUG] firewall gurus, help please!

From: Eben King (eben1@tampabay.rr.com)
Date: Sun Dec 14 2003 - 17:14:37 EST


OK. I've screwed up traceroute somehow. It worked under my previous
router (ipchains, Linux 2.0.x, P75), but I just checked it under my new
router (USR 8054), and it doesn't. From the inside, I get something like

[eben@pc eben]$ /usr/sbin/tracepath yahoo.com
 1?: [LOCALHOST] pmtu 1500
 1: usr8054 (192.168.1.25) asymm 2 0.518ms
 2: no reply
 3: no reply
... (repeat until killed)

And from the outside,
[eben@monkey eben]$ /usr/sbin/tracepath aaa.bbb.ccc.ddd
 1?: [LOCALHOST] pmtu 1500
 1: ssrb-core-msfc-v212.ns.ufl.edu (128.227.212.1) 0.724ms
...
19: ddd-ccc.bbb-aaa.tampabay.rr.com (aaa.bbb.ccc.ddd) asymm 15 82.184ms
20: no reply
21: no reply
... (repeat until killed)

When I tracepath the router, I get this:
[eben@pc networking]$ /usr/sbin/tracepath usr8054
 1?: [LOCALHOST] pmtu 1500
 1: usr8054 (192.168.1.25) asymm 2 0.675ms
 1?: usr8054 (192.168.1.25) asymm 2 reached
     Resume: pmtu 1500 hops 1 back 2

The network looks like this:

         +--------+
         | monkey |
         +--------+
              |
        ( internet )
              |
       +-------------+
       | cable modem |
       +-------------+
              |
          +------+ +-----------+
          | USR | | laptop |
          | 8054 ~ ~ (802.11b) |
          +------+ +-----------+
             |
 - - ----------------- - -
     | | | | |
    +-+ +-+ +-+ +-+ +-+
    |X| | | | | | | | |
    +-+ +-+ +-+ +-+ +-+
     ^
     my machine

AFAIK, I need to make sure ICMP "port unreachable" messages get to my
computer. Is this correct? Any idea how to do that? Thanks.

-- 
-eben    ebQenW1@EtaRmpTabYayU.rIr.OcoPm    home.tampabay.rr.com/hactar
CANCER:  The position of Jupiter says that you should spend the
rest of the week face down in the mud.  Try not to shove a roll of
duct tape up your nose when taking your driver's test.  -- Weird Al

----------------------------------------------------------------------- This list is provided as an unmoderated internet service by Networked Knowledge Systems (NKS). Views and opinions expressed in messages posted are those of the author and do not necessarily reflect the official policy or position of NKS or any of its employees.



This archive was generated by hypermail 2.1.3 : Fri Aug 01 2014 - 19:36:50 EDT