From owner-ssh@clinet.fi Thu Aug 20 08:59:44 1998 Received: from lohi.clinet.fi (majordom@lohi.clinet.fi [194.100.0.7]) by hutcs.cs.hut.fi (8.8.8/8.8.8) with ESMTP id IAA20592; Thu, 20 Aug 1998 08:59:40 +0300 (EET DST) Received: (from majordom@localhost) by lohi.clinet.fi (8.9.1/8.9.0) id IAA27610 for ssh-outgoing; Thu, 20 Aug 1998 08:53:47 +0300 (EEST) X-Authentication-Warning: lohi.clinet.fi: majordom set sender to owner-ssh@clinet.fi using -f Received: from [205.246.10.141] (ns.firetower.com [205.246.10.141]) by lohi.clinet.fi (8.9.1/8.9.0) with SMTP id PAA05915 for ; Mon, 17 Aug 1998 15:51:51 +0300 (EEST) Received: from firetower.com by [205.246.10.141] via smtpd (for lohi.clinet.fi [194.100.0.7]) with SMTP; 17 Aug 1998 13:53:59 UT Received: by firetower.com (v8) with SMTP id IAA00706; Mon, 17 Aug 1998 08:52:17 -0400 (EDT) Message-ID: <002001bdc9df$4f4035a0$0501fe0a@firetower.com> From: "Chris Poulin" To: "Tim Evans" , Cc: Subject: Re: [rapt] ssh and Eagle 5.03 (UNIX) Date: Mon, 17 Aug 1998 09:02:29 -0400 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 4.72.2106.4 X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4 Sender: owner-ssh@clinet.fi Precedence: bulk Raptor 5.x introduces a new feature in the VPN driver which blocks all traffic which is not associated with one of the standard proxies or user defined GSPs. In other words, it will accept traffic on ports 80, 443, 25, 23, 20, 21, etc, but not, for example, 110. In addition, if you disable a proxy (in config.cf or through the GUI), such as DNSd, the driver will block traffic to that port. BTW, the nomenclature 'VPN driver' is misleading, it does more than just VPN; it's the driver which handles transparency, address translation, filtering (both VPN and interface-based), etc. To force the driver to accept traffic on specific ports, edit the portcontrol.cf file and add statements in the form of: enable tcp 1234 (I may have the order reversed on tcp and 1234 -- I'm not near a firewall at the moment). This should solve your problem. --- Chris Poulin --- Network Management Consultant ph 508.359.4490 x22 FireTower, Inc. fx 508.359.4466 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Security ~ Architecture & Design ~ Management & Support ---------------- [ http://www.firetower.com ] ----------------- -----Original Message----- From: Tim Evans To: raptor-list@firetower.com Cc: ssh@clinet.fi Date: Monday, August 17, 1998 7:29 AM Subject: [rapt] ssh and Eagle 5.03 (UNIX) >Just upgraded from Raptor Eagle 4.0 to 5.03 on a Solaris system, and my >ssh access is now being blocked. The Eagle logfile has entries like: > >Aug 16 11:56:02 firewall kernel: 232 Sending ICMP port unreachable. Original packe >t (foo.bar.com[XXX.XX.XX.XX]->firewall[XXX.XX.XX.XX]: Protocol=TCP[SYN] Po >rt 1023->XXX) received on interface XXX.XXX.XXX.XXX > >Can someone suggest how to re-enable ssh access? > >ssh redirect *through* the firewall (to hosts inside) is working; it's just >access to the firewall itself that's failing. >-- >Tim Evans | 4 Beech Hill Drive >http://www.tkevans.com/tkevans.html | Newark, DE 19711 > >* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - >* This list is sponsored by FireTower & Raptor/Axent. >* To unsubscribe, send e-mail to >* with 'unsubscribe' as the BODY (not the subject) of the message. >* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - >