From: "Massimo S." <ecs-isp@2rosenthals.com>
Reply-To: ml@ecomstation.it
Subject: Re: [eCS-ISP] Injoy rule (portmap internet IP -> lan)
To: eCS ISP Mailing List <ecs-isp@2rosenthals.com>
References: <list-11460732@2rosenthals.com>
Organization: Massimo S.
Message-ID: <0dc3630a-402a-f64f-93b9-d6b6076ca70d@ecomstation.it>
Date: Tue, 24 Dec 2024 09:32:31 +0100
User-Agent: Mozilla/5.0 (OS/2; U; Warp 4.5; it-IT; rv:1.7.13) Gecko/20060424
 Thunderbird/1.0.8 Mnenhy/0.7.4.0
MIME-Version: 1.0
In-Reply-To: <list-11460732@2rosenthals.com>
Content-Type: text/plain; charset=iso-8859-15; format=flowed
Content-Language: it-IT
Content-Transfer-Encoding: 7bit

Il 15/12/2024 05:36, Steven Levine ha scritto:
> In <list-11420005@2rosenthals.com>, on 12/13/24
>     at 10:45 AM, "Massimo S." <ecs-isp@2rosenthals.com> said:
> 
> Hi Massimo,
> 
>>> Daytime_in_log
>>> 		Rule-Action = Log,
>>> 		Comment = "Packet received from 93.204.114.105:13",
>>> 		Source = "193.204.114.105",
>>> 		Source-port = "13",
>>> 		Protocol = UDP,
>>> 		Log-Control = Enabled,
>>> 		Log-Mask = "date time severity message resolved_source resolved_dest",
>>> 		Log-File = "daytime_in.log"
>>>
>>> Daytime_out_log
>>> 		Rule-Action = Log,
>>> 		Comment = "Packet received from 192.168.1.10:13",
>>> 		Source = "192.168.1.10",
>>> 		Source-Port = "13",
>>> 		Log-Control = Enabled,
>>> 		Log-Mask = "date time severity message resolved_source resolved_dest",
>>> 		Log-File = "daytime_out.log"
> 
> 
>>> This will allow to verify the your daytime client is really talking to the
>>> ports you think it is.
> 
>> thanks, but this rule do not produce any log
> 
> This confirms what I expected - that your original ruleset did not make
> sense based on my knowledge of daytime servers.  Typically, you would not
> be running an daytime server on your system, but rather you would be
> running at daytime client.  The client would connect to port 13 on the
> external daytime server.
> 
> This might get you some packets traced
> 
> Daytime_out_log
> 		Rule-Action = Log,
> 		Comment = "Packet received from 192.168.1.10:13",
> 		Source = "192.168.1.10",
> 		Destination-Port = "13",
>   		Log-Control = Enabled,
>   		Log-Mask = "date time severity message resolved_source resolved_dest",
>   		Log-File = "daytime_out.log"

hi,

this don't produce any log

but the server has 2 nics one with the public/wan IP and the 2nd is for internal lan 192.168.x.y

i'm starting to believe that Injoy do anything on the NIC2
since it's binded on the NIC1/WAN

massimo

>>> BTW, what daytime client are you trying to use?
>> i don't recall exactly,
> 
> You really ought get that problem fixed.
> 
>   but it works perfectly if i use mlink on the VM1
>> VM1 has 2 Nics
> 
>> maybe Injoy FW can't do what mlink does?
> 
> That's possible, but it still could be your rule set.
> 
>>>> This is the mlink rule:
>>>> link  daytime 0.0.0.0:13   193.204.114.105:13
>>>> access  daytime  192.168.1.10
> 
> Having never used mlink, my read of this rule is that any attempt to
> connect via port 13 will be sent to port 13 at 193.204.114.105 as long as
> the attempt originates from an interface bound to 192.168.1.10.
> 
> I would not call this port forwarding.  It's more link NAT to my way of
> thinking.
> 
> Steven
>