Hello, I'm Cc:-ing this message to the zorp mailing list as well. On Tue, Jun 26, 2001 at 02:38:42PM +0000, sameer multani wrote:
I want to configure zorp to connect to my ftp server 192.168.91.14 in DMZ from internet m/c 202.60.30.2
My firewall internet interface is 202.60.30.1 " " DMZ " " 192.168.91.23
When i use DirectedChainer it gives me error at Listener(..) function. While if i replace it with TransparentChainer it gives no error. Zorp Ftp Proxy starts and asks for the authentication and after entering the username and password in logs it says
dropped line USER sameer and stops Ftp Proxy.
My Linux box has no ftp server running.
Can you tell me where am i going wrong?
I cleaned up your policy.py file (removed comments remaining from the sample policy. I marked my changes. # # sample firewall policy with transparent access to FTP, HTTP and CVS # protocols. # For FTP and HTTP we use application level gateways, for CVS we use a plug. # (as long as CVS protocol proxy is not available) # # firewall internal network: 192.168.91.0/24 # firewall internal interface: 192.168.1.23 # firewall external interface: 202.60.30.1 from Zorp.Zorp import * from Zorp import Zorp from Zorp.Zone import InetZone from Zorp.Service import Service from Zorp.SockAddr import SockAddrInet from Zorp.Chainer import TransparentChainer, DirectedChainer, InbandChainer, FailoverChainer from Zorp.Plug import PlugProxy from Zorp import Http from Zorp.Http import HttpProxy from Zorp.Ftp import FtpProxyAllow, FtpProxyMinimal, FtpProxy from Zorp.Listener import Listener Zorp.firewall_name = 'sameer@firewall' InetZone("dmz", "192.168.91.0/24", inbound_services=["itod_ftp"], outbound_services=["dtoi_ftp"]), InetZone("internet", "0.0.0.0/0", inbound_services=["*"], outbound_services=["*"]) class dtoi_ftp(FtpProxyAllow): def config(self): FtpProxyAllow.config(self) #self.transparent_mode = TRUE # the following two lines are not needed # for zorp later than 0.8.x, # ip addresses are automatically determined #self.fw_server_data.ip_s = "202.60.30.1" #self.fw_client_data.ip_s = "192.168.91.23" class itod_ftp(FtpProxyAllow): def config(self): FtpProxyAllow.config(self) #self.transparent_mode = FALSE # I commented these out, just like the previous ones #self.fw_server_data.ip_s = "192.168.91.23" #self.fw_client_data.ip_s = "202.60.30.1" # although def init() can still be used, the recommended way is # to use def _instance_name(), so I changed the definition below # zorp is the default instance name. def zorp(): # create services # this assignment is not needed, again a change between # 0.6.x and 0.8.x, services are simply identified by their # name. # dtoiftp = \ Service("dtoiftp", TransparentChainer(), dtoi_ftp) #itodftp = \ Service("itodftp", DirectedChainer(SockAddrInet("192.168.91.14", 21), itod_ftp) # Service("itodftp",TransparentChainer(), itod_ftp) Listener(SockAddrInet("202.60.30.1", 21), "itodftp") Listener(SockAddrInet("192.168.91.23", 21), "dtoiftp") --- end of policy --- This policy file should work now. If you have a problem (an error message for example), please send me the traceback (it is sent to the syslog) Zorp can work both in transparent and in non-transparent mode. Your proxies are configured in transparent_mode (the default setting), and you are listening on port 21. If you want transparent mode (when you simply connect to the ftp server from the client, without first having to connect to the proxy), you should listen on a port other than 21, and redirect traffic going through your firewall to your local listener using ipchains. For example: we listen on port 50021: Listener(SockAddrInet("192.168.91.23", 50021), "dtoiftp") and we use this ipchains rule to redirect traffic: ipchains -A input -i <DMZ interface> -p tcp -s 192.168.91.0/24 ! -d 192.168.91.23 21 -j REDIRECT 50021 (similarly in the other direction) For this to work, you'll have to enable IP forwarding in your kernel (and place a default DENY in your FORWARD chain). Other suggested IP stack settings: rp_filter off (substitute with appropriate ipchains rules) ip_dynaddr off ip_forward on tcp_keepalive_* set to a short timeout, and small number of probes You might need to increase the number of file descriptors, and number of processes in your kernel, otherwise you might run out of them quite quickly. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1