[SOLVED] Port/IP Forwarding in Solaris 10.0

vikas027 · 10-10-2009, 05:58 AM

Hi,

I am looking out a way to forward all UDP traffic coming on ports 3001,3002,3003 and 3004 on server 10.2.45.100
to
corresponding ports of server 10.2.45.101.

I am using Solaris 10.0.

Code:

-bash-3.00$ uname -a
SunOS airtelussd2 5.10 Generic_127127-11 sun4u sparc SUNW,Sun-Fire-V445

Is there someway out in Solaris to accomplish this ?

jlliagre · 10-10-2009, 08:51 AM

This can be done using IP Filter's NAT:
http://docs.sun.com/app/docs/doc/816-4554/euqfc?a=view

vikas027 · 10-10-2009, 09:02 AM

Quote:

Originally Posted by jlliagre

This can be done using IP Filter's NAT:
http://docs.sun.com/app/docs/doc/816-4554/euqfc?a=view

Thanks a ton Jlliagre for you reply. I was just googling ipfilters only.

I have a little confusion, what kind of rules are defined in ipnat.conf and and Packet Config. File (/etc/ipf/ipf.conf).

To accomplish my task, would this be enough in ipnat.conf ? Do I need to write some rules in ipf.conf too ?

Code:

rdr bge1:1 75.126.76.41/8 port 30118 -> 10.2.45.101 port 30118 udp
rdr bge1:1 75.126.76.41/8 port 30119 -> 10.2.45.101 port 30119 udp
rdr bge1:1 75.126.76.41/8 port 30120 -> 10.2.45.101 port 30120 udp
rdr bge1:1 75.126.76.41/8 port 30121 -> 10.2.45.101 port 30121 udp

Please suggest.

jlliagre · 10-14-2009, 03:48 AM

I believe you are in a better position than anyone else to answer your own question. Did you try this configuration ? What was the result ?

avijitp · 10-14-2009, 09:16 AM

What is the value you get for this:

Code:

ndd -get /dev/tcp ip_forwarding

Is ip forwarding enabled in your system?

jlliagre · 10-14-2009, 02:44 PM

IP forwarding (i.e. routing) has very little if anything to do with TCP/UDP port forwarding.

vikas027 · 10-14-2009, 11:08 PM

Quote:

Originally Posted by avijitp

What is the value you get for this:

Code:

ndd -get /dev/tcp ip_forwarding

Is ip forwarding enabled in your system?

Yes, it is.

Code:

# ndd -get /dev/tcp ip_forwarding
1

vikas027 · 10-14-2009, 11:19 PM

Quote:

Originally Posted by jlliagre

I believe you are in a better position than anyone else to answer your own question. Did you try this configuration ? What was the result ?

I tried writing rules both in ipf.conf and ipnat.conf. Here, are these.

ipf.conf

Code:

pass in quick log proto udp from 75.126.76.41 port = 30118 to 10.2.45.197 port = 30118
pass in quick log proto udp from 75.126.76.41 port = 30119 to 10.2.45.197 port = 30119
pass in quick log proto udp from 75.126.76.41 port = 30120 to 10.2.45.197 port = 30120
pass in quick log proto udp from 75.126.76.41 port = 30121 to 10.2.45.197 port = 30121

ipnat.conf

Code:

rdr bge1:1 75.126.76.41/8 port 30118 -> 10.2.45.197 port 30118 udp
rdr bge1:1 75.126.76.41/8 port 30119 -> 10.2.45.197 port 30119 udp
rdr bge1:1 75.126.76.41/8 port 30120 -> 10.2.45.197 port 30120 udp
rdr bge1:1 75.126.76.41/8 port 30121 -> 10.2.45.197 port 30121 udp

I have enabled rules in ipf.conf

Code:

# ipfstat -io
empty list for ipfilter(out)
pass in log quick proto udp from 75.126.76.41/32 port = 30118 to 10.2.45.197/32 port = 30118
pass in log quick proto udp from 75.126.76.41/32 port = 30119 to 10.2.45.197/32 port = 30119
pass in log quick proto udp from 75.126.76.41/32 port = 30120 to 10.2.45.197/32 port = 30120
pass in log quick proto udp from 75.126.76.41/32 port = 30121 to 10.2.45.197/32 port = 30121

BUT, unable to apply rules of ipnat.conf, I am getting this error.

Code:

# ipnat -C -f ipnat.conf
0 entries flushed from NAT list
syntax error error at ":", line 1

Seems like it ipnat doesn't takes interface name with ":". However, this is working fine.

Code:

rdr bge1 75.126.76.41/8 port 30118 -> 10.2.45.197 port 30118 udp

Any suggestions.

jlliagre · 10-14-2009, 11:32 PM

I don't see what is the purpose of the ipf.conf rules. The firewall passes all traffic by default so it shouldn't change anything to explicitly allow traffic when none is blocked.

About bge1:1, the documentation indeed states interfaces must not be virtual ones. Using bge1 shouldn't be a problem. Aren't the ports forwarded with you latest settings ?

vikas027 · 10-15-2009, 09:49 PM

Quote:

Originally Posted by jlliagre

I don't see what is the purpose of the ipf.conf rules. The firewall passes all traffic by default so it shouldn't change anything to explicitly allow traffic when none is blocked.

About bge1:1, the documentation indeed states interfaces must not be virtual ones. Using bge1 shouldn't be a problem. Aren't the ports forwarded with you latest settings ?

Hi,

Actually, I have these two interfaces on my system, and UDP traffic is coming on 10.2.45.200. So, I believe putting bge1 in ipnat.conf will not serve my purpose.

Code:

bge1: flags=1100843<UP,BROADCAST,RUNNING,MULTICAST,ROUTER,IPv4> mtu 1500 index 3
        inet 0.0.0.0 netmask ff000000 broadcast 0.255.255.255
        groupname ipmp0
        ether 0:14:4f:c4:79:bd
bge1:1: flags=1140843<UP,BROADCAST,RUNNING,MULTICAST,DEPRECATED,ROUTER,IPv4> mtu 1500 index 3
        inet 10.2.45.200 netmask ffffff80 broadcast 10.2.45.255

jlliagre · 10-16-2009, 02:10 AM

There is a single bge1 physical interface. The firewall is processing all packets that flow into it, regardless of their IP address.

vikas027 · 10-17-2009, 05:30 AM

Quote:

Originally Posted by jlliagre

There is a single bge1 physical interface. The firewall is processing all packets that flow into it, regardless of their IP address.

Yes, But I need to process traffic coming on 10.2.45.200.

Is there some way out ?

jlliagre · 10-17-2009, 04:44 PM

That's what I'm trying to explain. Traffic coming on 10.2.45.200 will pass through the bge1 physical interface.

vikas027 · 10-18-2009, 04:11 AM

Quote:

Originally Posted by jlliagre

That's what I'm trying to explain. Traffic coming on 10.2.45.200 will pass through the bge1 physical interface.

Okay, now I understand.

So, I believe this should help me out.

Code:

# ipnat -l
List of active MAP/Redirect filters:
rdr bge1 75.0.0.0/8 port 30118 -> 10.2.45.197 port 30118 udp
rdr bge1 75.0.0.0/8 port 30119 -> 10.2.45.197 port 30119 udp
rdr bge1 75.0.0.0/8 port 30120 -> 10.2.45.197 port 30120 udp
rdr bge1 75.0.0.0/8 port 30121 -> 10.2.45.197 port 30121 udp

I will do some testing and will update.

Thanks a ton for your help and patience.

vikas027 · 10-18-2009, 04:52 AM

Hi Jlliagre,

I tested it successfully.

Thanks a TON.

I owe you a beer can.