Trying to get traffic through Astaro 220

crburchett · #1 (**permalink**) 07-02-2009, 09:16 PM

I am trying to allow traffic to pass through port 5100 to an internal IP address. I have created a packet filter rule as follows: External >> Service (port 5100) >> Device.

Internal traffic passes over the port without issue. However, external traffic can't get through. I have placed the rule at the top of the list in an effort to bypass all others, but it still won't work.

Any insight would be greatly appreciated.

trollvottel · #2 (**permalink**) 07-02-2009, 09:29 PM

Is the internal IP in a private range? If yes, you must already have Masquerading activated. To directly pass specific external traffic to an internal host, you must create a DNAT rule.

BAlfson · #3 (**permalink**) 07-02-2009, 10:59 PM

You should search for this information here and on the Astaro KnowledgeBase.

I would eliminate the PF rule and create a DNAT rule:

Traffic Source: Any
Traffic Service: [Port 5100 service]
Traffic Destination: External (Address)

NAT mode: DNAT (Destination)

Destination: [Host definition Device]
Destination Service: [leave blank]

Automatic packet filter rule: checked

Cheers - Bob

khardeveld · #4 (**permalink**) 07-04-2009, 05:25 PM

Quote:

Originally Posted by BAlfson

Automatic packet filter rule: checked

I've had some discussions about this. Big advantage is that you don't have to create separate packet filters, and you define everything for this particular port in one place. Disadvantage is that you cannot log taffic, and you will always have to look in two separate places to see what ports are enabled for the outside world.

Given the latter two reasons, we don't check this in DNAT, but create a separate rule. What's the general opinion here?

crburchett · #5 (**permalink**) 07-08-2009, 04:53 PM

Thanks for the information, it helped me resolve the issue. I am relatively new to the Astaro, so I apologize for asking a seemingly simple question.

BAlfson · #6 (**permalink**) 07-08-2009, 09:31 PM

khardeveld, I agree to some extent. I just this year began using the auto rules. Now I prefer them, but will uncheck one and replace it with a rule at the top of the packet filter rules when I need to debug. I keep an inactive rule there all the time so the rule numbers don't change, and Rule #1 in the PF log is always my debugging rule.

Version 7.5, now in beta, allows you to log auto rules.

I like using auto rules now because it cuts down on the clutter in the explicit PF rule list.

Cheers - Bob