|
||||||||
On 1/3/06, Chuck Mariotti <cmariotti at xunity dot com> wrote: > > I would like to only open ports that are needed (of course). > > I have two network cards, one public (eg. 211.211.211.130 -> 162) , one > private (eg. 10.10.10.1 -> 254)... (not my real IP addresses, just > examples) > > Firewall has two IP addresses 211.211.211.130 and 10.10.10.1... > I have setup Server NAT... have all the public IP addresses listed > there... server NAT is just over complicating things. Use 1:1, you seem to have sufficient public IP's for all the servers involved. That's more than likely how you had the PIX set up ('static (inside,outside) ...'), otherwise you would have ended up with an even more complex setup there. > I have one Proxy ARP entry which specifies the whole Public IP Address > Range (not sure I need this, or if this is right, see below). that's correct. > > 1. Email / SMTP > I am running Exchange 2003... The SMTP server should be publically > known as 211.211.211.140 and internally has 10.10.10.140 ... I have an > Inbound Firewall rule setup for Port 25... All inbound email seems to be > getting in (limited testing seems to work). However, this is where > things get odd and I need a solution. Outbound messages are sent, but > are using the public IP 211.211.211.130 (the firewall address) instead > of .140 (the mailserver address). I > basically need a 1:1 mapping, but I only want SMTP traffic... > enter the 1:1 rules, then enter the appropriate firewall rules. > 2. FTP this might be of some help. http://wiki.m0n0.ch/wikka.php?wakka=PasvFTP > I did a 1:1 but that opened everything up for that > external IP. not unless your firewall rules say so. anything that isn't explicitly permitted, under any circumstance, is denied. Just permit what you need. One thing to keep in mind, the destination IP, unlike the PIX and many other firewalls, will be the private IP of the server, not the public IP. NAT applies first, then firewall rules. Also pay attention to the source port, which isn't apparent (or available at all) for many firewalls. Set this to any (or 1024-65535 if you're a stickler, the ephemeral port range), not the same as the destination port. In summary: Delete all the server NAT stuff you have in there now, add 1:1 NAT rules, and add firewall rules. -Chris |