I think you miss "TransparentChainer(None,1)" . Meaning: "None": use firewall interface address "1" : is a boolean, and means forge address. So, You use a private netaddress so I think this address not routed at the destination net. Best Regards: Endre Wagner 0.7.7-es zorp van fent es nem igazan akar mukodni a kov. policy: # Zorp config file ###################################################################### from Zorp.Zorp import * from Zorp import Zorp from Zorp.Zone import InetZone from Zorp.Service import Service from Zorp.SockAddr import SockAddrInet from Zorp.Chainer import TransparentChainer, DirectedChainer, InbandChainer from Zorp.Plug import PlugProxy from Zorp import Http from Zorp.Http import HttpProxy from Zorp.Ftp import FtpProxyAllow from Zorp.Listener import Listener Zorp.firewall_name = 'zorp@firewall' Zorp.zones= [ InetZone("intranet","192.168.2.0","255.255.255.0",None, outbound_services=["plug_trans"], inbound_services=[]), InetZone("internet","0.0.0.0","0.0.0.0",None, outbound_services=[], inbound_services=["plug_trans"]), ] class MyPlug(PlugProxy): def config(self): pass def init(name): trans_plug = Service("plug_trans",TransparentChainer(),MyPlug) Listener(SockAddrInet("192.168.2.1",2525),trans_plug) ############################## Csatlakozni tudok a tavoli mail szerverhez de visszafele nem jon semmi. A forraskodon kivul van mar valami mas doksi is? Mag irt valamit egy 180 oldalas doksirol. elerheto az valahol? Andars -------------------------------------------------------------------------- "A Linux nem mas, mint szellemes megoldasok tomeny es dinamikus halmaza, amely a kivancsi embert folyamatosan ellatja kiprobalni valo csemegevel." --------={ United Nazbuls homepage: http://lino.kvif.hu/~farago }=-------- _______________________________________________ zorp mailing list zorp@lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/zorp
I think you miss "TransparentChainer(None,1)" . Meaning: "None": use firewall interface address "1" : is a boolean, and means forge address.
So, You use a private netaddress so I think this address not routed at the destination net.
the 0.7 version of Zorp changes some Chainer parameters. TransparentChainer is good as it was in the policy. As I see you are trying to enable outbound SMTP with zorp. Did you add a redirect rule to your ipchains config? PS: you can use the zorp-hu mailing list for Hungarian submissions. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt
On Tue, 19 Dec 2000, Balazs Scheidler wrote:
the 0.7 version of Zorp changes some Chainer parameters. TransparentChainer is good as it was in the policy.
As I see you are trying to enable outbound SMTP with zorp. Did you add a redirect rule to your ipchains config? Yes. I added. ipchains -I input -i eth1 -p tcp -d 0.0.0.0/0 25 -j REDIRECT 2525 eth1 is the inside of the firewall (192.168.2.1), the outside is eth0 (192.168.1.159)
PS: you can use the zorp-hu mailing list for Hungarian submissions. Sorry for the mail.
-- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt
_______________________________________________ zorp mailing list zorp@lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/zorp
the 0.7 version of Zorp changes some Chainer parameters. TransparentChainer is good as it was in the policy.
As I see you are trying to enable outbound SMTP with zorp. Did you add a redirect rule to your ipchains config? Yes. I added. ipchains -I input -i eth1 -p tcp -d 0.0.0.0/0 25 -j REDIRECT 2525 eth1 is the inside of the firewall (192.168.2.1), the outside is eth0 (192.168.1.159)
1) for redirections to work you need to enable IP forwarding in your kernel (even if you have a deny in your forward CHAIN) 2) can you send me the syslog generated by zorp? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt
On Tue, 19 Dec 2000, Balazs Scheidler wrote:
1) for redirections to work you need to enable IP forwarding in your kernel (even if you have a deny in your forward CHAIN) Yes. IP forwarding is enabled. The current kernel working perfectly with the older versions of Zorp. 2) can you send me the syslog generated by zorp? Dec 20 11:15:10 erasmus zorp-http[4693]: Verbosity level: 4 Dec 20 11:15:10 erasmus zorp-http[4693]: zorp version 0.7.7 starting up Dec 20 11:15:45 erasmus zorp-http[4693]: (zorp/plug_trans:0/plug): session_start, module=plug Dec 20 11:15:45 erasmus zorp-http[4693]: (zorp/plug_trans:0/plug): client_fd=10, client_addr=AF_INET(192.168.2.2:1576) Dec 20 11:15:46 erasmus zorp-http[4696]: (zorp/plug_trans:0/plug): server_fd=11, server_addr=AF_INET(193.224.167.248:25) ^^^^^^^^^this is normal? Andras
1) for redirections to work you need to enable IP forwarding in your kernel (even if you have a deny in your forward CHAIN) Yes. IP forwarding is enabled. The current kernel working perfectly with the older versions of Zorp. 2) can you send me the syslog generated by zorp? Dec 20 11:15:10 erasmus zorp-http[4693]: Verbosity level: 4 Dec 20 11:15:10 erasmus zorp-http[4693]: zorp version 0.7.7 starting up Dec 20 11:15:45 erasmus zorp-http[4693]: (zorp/plug_trans:0/plug): session_start, module=plug Dec 20 11:15:45 erasmus zorp-http[4693]: (zorp/plug_trans:0/plug): client_fd=10, client_addr=AF_INET(192.168.2.2:1576) Dec 20 11:15:46 erasmus zorp-http[4696]: (zorp/plug_trans:0/plug): server_fd=11, server_addr=AF_INET(193.224.167.248:25) ^^^^^^^^^this is normal?
zorp-http is the name of your instance, so if your instances.conf has an entry starting with zorp-http (as name), your instance will be named as zorp-http, thus it'll be used for logging. The currently used proxy module is shown by the session_id: (zorp/plug_trans:0/plug) ^^^^ - firewall name ^^^^^^^^^^ - service ^ service instance number ^^^^ used proxy module What is the server address you are trying to address? I presume 193.224.167.248:25. It should work, and it does work for me. Can you check with tcpdump if anything is received by Zorp? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt
A forraskodon kivul van mar valami mas doksi is? Mag irt valamit egy 180 oldalas doksirol. elerheto az valahol?
The above means in English: is there any documentation besides the source? Mag has written something about a 180 pages doc, is it available somewhere? My answer is: that documentation is written into docstrings in Python, which can be used to generate .html or .ps docs using pythondoc. I'm however not satisfied with the way it looks like, so I'm currently trying to hack pythondoc a bit. For the time being, you can generate reference docs using: cd pylib/Zorp mkdir html find . -name \*.py | grep -v __init__ | xargs pythondoc -i -d html -f HTML4 The generated docs will be found in the ./html subdirectory. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt
participants (3)
-
Balazs Scheidler
-
endre.wagner＠dataware.debis.hu
-
farago＠ns.edu.kvif.hu