isc mailing list manager ecartisiscorg firewalls digest thu 25 jul 2002 volume 01 issue 033 issue qos fw disable sites dnat iptables question dnat iptables question george j jahchan subject qos date thu 25 jul 2002 121140 0300 im forced conclude packetshaper either sucks major way explanationthe explanation given wrong sorry wrong counts explanation valid symmetrical tcp others see explanations yes packets established tcp connection ack flag set packets except syns candidates delay traffic limits exceeded whoops change always candidates predictive preventive delay acks delayed per flow way wanbound traffic reaching edge routers ethernet interface exceed wan link speed router queues wait link near saturation act unlike queueing predictive reactive slows rate transmission sending hosts perflow basis accommodate wan link speed limit current network utilization rather fill queues lan speeds empty wan speeds eventually dropping excess queues fill informing hosts slow rate transmission queues beyond fixed threshold 90 rate control works equally well outbound inbound traffic ever heard effective queueing technology inbound traffic queueing packets crossed congested link make much sense ipsecgre encapsulated traffic obviously dissect ipsecgre encapsulated traffic sees tunnel one connection tunneling device ps lan side vpn gateway router two separate devices ps router tunneling ps sees clear traffic typically organization first scenario would case headquarters second branch offices ps branch sees traffic inside tunnel whereas unit hq sees traffic one tunnel allows full management tunneled clear traffic ends udp asymmetrical tcp ps router see outgoing packet return traffic coming back satellite downlink station lan handled differently asymmetrical tcp time release packets receiving device thereby indirectly timing release acknowledgements receiving host informs senders tcpip stack slow release packets limited bandwidth available udp utilizes flowbased derivative random drop selectively drops one packet time flows predicted cause congestion prevents heavy retransmissions application timeouts icmp packets exceeding policy limits dropped _maybe_ special case tcp try offload queueing endpoints really dont see real gain real gain manageability control lan host knows state connections oblivious wan conditions tcpip stack learns router queues nearly full wan congested ps predict inform lan hosts tcpip stacks speed limit obey every connection based policies network conditions avoiding congestion control asymmetrical tcp udp may tight symmetrical tcp work queueing akin deploying cops traffic jams occur vs rate control cops permanently deployed throughout town communicating central control point predicting upcoming congestion regulating traffic ensuring smooth flow traffic potential congestion take driver hell lot longer cross town first approach second agree original message mikael olsson george j jahchan cc firewalls list sent wednesday july 24 2002 450 pm subject qos george j jahchan wrote whole purpose device proactively prevent wan congestion sits client server client insideserver outside client outsideserver inside make difference proactively adjusts tcp window size delaying acknowledgement get sending host honor speed limit individual connection calculated realtime based userdefined policies current network conditions umm dont get wrong think youve fed lessthan accurate sales pitch lets ponder minute device works delaying acks packets ack flag set right letting sink yes packets established tcp connection ack flag set packets except syns candidates delay traffic limits exceeded whoops okay lets assume second packets arent actually delayed ack sequence numbers tcp window size fields rewritten dicey youve accomplished move queueing delaying traffic shaper endpoints still get l7tol7 delays big deal happens wire stack also convincing endpoints delays probably results lessthanperfect shaping since stack retransmit timings suddenly affect actual bandwidth available rather shaper shaper knows exactly bandwidth available doesnt even begin touch protocols like udp icmp matter ipsecgrewhatever tunneled traffic neither sequence numbers window sizes manipulate im forced conclude packetshaper either sucks major way explanationthe explanation given wrong sorry think happens delay 2msec long traffic limits arent exceeded reasonable traffic exceeds limits things begin queued wellbehaved tcp stack _will_ mean fall back lower transmission rates tcp designed part isnt wrong kind shaping isnt rocket science say shapers plain dumb always queueing selecting gets transmitted queue well cant see get smarter queueing limits actually exceeded _maybe_ special case tcp try offload queueing endpoints really dont see real gain respectfully mikael olsson mikael olsson clavister ab storgatan 12 box 393 se891 28 rnskldsvik sweden phone 46 0660 29 92 00 mobile 46 070 26 222 05 fax 46 0660 122 50 www httpwwwclavistercom july im vacation cant tell firewalls mailing list firewallsiscorg unsubscribe httpwwwiscorgservicespubliclistsfirewallshtml hiemstra brenno subject fw disable sites date thu 25 jul 2002 134418 0200 list addy changed ofcourse original message hiemstra brenno sent donderdag 25 juli 2002 1227 michael zhao hiemstra brenno cc firewallslistsgnacnet subject disable sites michael shoes would first investigate security policy organisation dont know mean security policy would advice start reading search google would big help security policy would read investigate tells employees able use workstations performing function security policy things employees allowed network internet isnt security policy would advice implement one company without one cant punish employees violating policy court case dont rock solid thing smack around without policy implementing solutions prevent employees things im opinion arent allowed workstations anyway dont like idea employees play games use kazaa icq msn etc etc stead working pay security policy important say employees violated consequences deny internet access etc etc owkee way time proceed proxy thingie proxy dont default gateway network use function internet explorer whatever browser use network ask checkpoint firewalls good using real purpose firewalling network dont like idea firewall also cvs http thingie dont think firewall purpose proxies much better solutions also developed purpose depending network setup os proxy brand current proxy several solutions already provided people list favorite proxy squid probably lot http blacklist programs work squid block websites stuff still think first deny direct internet traffic workstations allow traffic internet servers allowed think proxies email servers etc etc also prevent people playing games especially quake kinda games use ports arent necessary normal webbrowsing games running port 80 http related blocked proxy proxy true layer 7 application layer proxy kinda proxies view tcpip packet see legitimate http traffic someone tries tunnel something port 80 anyway food thoughts regards brenno original message michael zhao smtpmzhaoeverlastingsystemscom sent woensdag 24 juli 2002 238 hiemstra brenno cc firewallslistsgnacnet subject disable sites thanks reply built network three years ago proxy use cache accelerate internet accessing gateway difficult change topology many thing need changed another idea help someone suggest buy websence dont budget right thanks lot michael hiemstra brenno wrote michael first thing build security policy states people allowed everyone needs accept policy violate apply rules state security policy option network setup would install proxy server demand every client connect proxy want use internet proxy allow http ftp approved services connect internet let check database websites allowed deny access sites arent allowed company firewall allow proxy connect internet clients denied way clients cant connect directly internet game servers proxy deny clients connect game servers hope option regards brenno original message michael zhao smtpmzhaoeverlastingsystemscom sent dinsdag 23 juli 2002 1410 firewallslistsgnacnet subject disable sites hi choose checkpoint fw1 firewall found many company users play internet games like cs ourgame find users download clients software install local workstation run programe connect game server automatically usally many sites every internet game server ie want disable accessing game servers like xxxourgamecom internal net except find ip address complecat tell regards michael firewalls mailing list firewallsiscorg unsubscribe httpwwwiscorgservicespubliclistsfirewallshtml date thu 25 jul 2002 150821 0600 jerry lynde subject dnat iptables question howdy folks ive scouring online docs solid info accomplish dnat iptables essentially converted ipmasqadm lines form ipmasqadm portfw p tcp l web_out http r web_in http iptables lines form iptables prerouting nat p tcp web_out dport 80 j dnat web_in80 accompanying lines iptables forward intif extif state state establishedrelated j accept iptables forward extif intif state state establishedrelated j accept iptables forward extif intif p tcp j accept last two lines seem functionally sorta redundant threw em effort make work far unable show working correctly even tried logging packets iptables forward intif p tcp j log loglevel info iptables forward extif p tcp j log loglevel info nothing show varlogmessages anywhere else matter redhat 73 box help clues flames rthis particularfm etc appreciated read list please dont reply directly addition list resposne thanks jer reckhard tobias subject dnat iptables question date fri 26 jul 2002 083237 0200 iptables prerouting nat p tcp web_out dport 80 j dnat web_in80 accompanying lines iptables forward intif extif state state establishedrelated j accept iptables forward extif intif state state establishedrelated j accept iptables forward extif intif p tcp j accept last two lines seem functionally sorta redundant threw em effort make work youre missing new state initial syn packet match either first two rules match third inbound though far unable show working correctly even tried logging packets iptables forward intif p tcp j log loglevel info iptables forward extif p tcp j log loglevel info nothing show varlogmessages anywhere else matter need insert logging rules accept reject deny rules use sure packets hitting box try moving log rules top forward chain introduce logging rules prerouting postrouting input output chains andor use tcpdump well see packets travelling cheers tobias end firewalls digest v1 33 thu 25 jul 2002 235100 0700 pdt firewalls digest v1 33