PF rdr problem -- CLOSED:SYN_SENT

From: Aaron Couts (spam_at_couts.org)
Date: 02/18/05 

Date: Fri, 18 Feb 2005 17:43:39 GMT

My office has two internal networks, and the one I'm on doesn't have a
printer. So I'm setting up a port-forwarding OpenBSD box to forward
port 9100 connections from my network to the printer on the other network.

Here's my pf.conf:

ext_if="rl0"
int_printer="10.0.131.99"
rdr pass on $ext_if proto tcp from any to any port 9100 -> $int_printer \
 port 9100

Here's a picture of what I'm doing:

192.168.1.0/24 -> 192.168.1.99 / 10.0.131.191 -> 10.0.131.99
  my network ext_if OpenBSD int_if printer

The network on the OpenBSD machine is setup correctly; I can connect to
and from machines on both networks using the OpenBSD box. However when
I try to utilize the port forwarding, I can't connect:
$ pfctl -ss
self tcp 10.0.131.99:9100 <- 192.168.1.99:9100 <- 192.168.1.107:1854 \
       CLOSED:SYN_SENT

Any attempts to connect just hang. Anyone have any hints?

BTW I was able to do this successfully using a Linksys router. The wierd
thing was that I could print from Linux machines but not from Windows
machines. The JetDirect card on the printer has a configuration tool that
can be accessed by telnetting to port 23. From a Linux machine I could
"telnet 192.168.1.99" and get the config tool, but from Windows machines
I got "connection timed out" using the same command. Weird. 

-- 
To contact me via email, substitute 
'aaronc' for 'spam' in my address.
http://www.towerdata.com

Relevant Pages

  • Re: Update: UDP 770 Potential Worm
    ... > I still believe that the packets may be the result ... with the goal of knocking machines ... the network immediately after the 'attack', ... destined to port if you haven't sniffed it somehow? ...
    (Incidents)
  • Re: all ip addresses of machines in the local network
    ... database onto different machines residing in the same network. ... I expect that you would know the IP range for your network. ... the particular port. ... Amit Khemka -- onyomo.com ...
    (comp.lang.python)
  • Re: A Lot of Traffic on Network
    ... have you checked out the machines that are ... bigger switches and hubs i have seen there is usually a port activity light ... > Actually our network administrator quit. ...
    (microsoft.public.win2000.security)
  • RE: Blocking SMT Connections by clients
    ... > worthy of a blacklisting. ... The network is regularly ... > to construct a packet filter to do this - block any machines INSIDE ... > the network from making TCP connections to REMOTE hosts on port 25.. ...
    (microsoft.public.isa.configuration)
  • Re: security question
    ... address may be just a NAT for a larger network behind it, ... Unisite Internet Presence Provider ... As long as you open your port 22 to the world, ... machines or networks that need the access. ...
    (linux.redhat)
Loading