When it's not an Internet gateway :-) We have two live examples. In one case, we are creating a RAS gateway for mobile IPSec clients. We need to relay the traffic from the RAS gateway to the branch offices. Since the source address for the tunnel on the RAS end of the RAS gateway to office gateway tunnel can be anything, we would have to define the security policy as between the protected network behind the office gateway and 0.0.0.0/0. That will surely confuse the office gateway who will now think all traffic must be sent to the RAS gateway. We can solve this problem by NATting all clients to a fixed address range and creating a tunnel between that address and the protected networks behind the branch office gateway. We do not want to do this via L2TP because we wish to perform access control decisions on the traffic while it is still traversing netfilter. The other example is in a multi-client environment where there are unresolvable IP address conflicts and the entire client network must be NATted to the client support center. Yes, I know NAT is evil ;-) but it is also sometimes eminently practical - John On Mon, 2005-09-19 at 12:36 -0700, Hudson Delbert J Ctr 61 CS/SCBN wrote: > John, > > not sure I can think of valid reason to allow netbios traverse an > internet gateway in the first place. > > Please explain scenario. > > Piranha. > > > -----Original Message----- > From: netfilter-bounces@xxxxxxxxxxxxxxxxxxx > [mailto:netfilter-bounces@xxxxxxxxxxxxxxxxxxx] On Behalf Of John A. > Sullivan III > Sent: Monday, September 19, 2005 11:59 > To: Netfilter users list > Subject: Win2K + and NAT > > Does anyone have a work around for Outlook and Windows File & Print > services through a NAT gateway in a Win2K and XP environment with Active > Directory? We have a situation where we do have to pass this kind of > traffic through such a gateway and it breaks. > > We see the client send SAM LOGON requests on netbios datagram service > 138/udp. I would guess the client is registering but I'm not sure. The > problem is that the netbios header contains the source IP address. Once > we NAT, this does not match the IP header IP address. We see the > packets arriving at the AD controller with the NAT address but we see > the replies being sent to the original address (the one in the NetBIOS > header). > > It appears there is no nat helper for netbios dgm although there is the > start of one at http://suif.stanford.edu/~csapuntz/ip_nat_netbios.c - in > fact, if no one has a work around, we might be interested in sponsoring > someone to finish and submit this patch. Please let me know if you are > interested. > > Has anyone gotten such a set up to work? Perhaps there is a way to > manipulate the behavior of Outlook and Windows to get the information > via a different protocol? Thanks - John <snip> -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan@xxxxxxxxxxxxxxxxxxx If you would like to participate in the development of an open source enterprise class network security management system, please visit http://iscs.sourceforge.net
