f



Sunscreen 3.2 / Stateful UDP

I'm running Sunscreen 3.2 (routing mode) on Solaris 9 with only one
public IP address (using hme0). I've got a local network
192.168.1.0/27 (using znb0).  I also have one DMZ
192.168.1.224/27 (using znb1). Since Sunscreen doesn't support
port forwarding I've statically NAT'd the external IP to DMZ host
and have two packet filter rules that allow SMTP in/out for that
host.  Currently the internal net is being NAT'd using Dynamic mode on the
Screen. This works fine and all TCP traffic is tracked via the statetable.
But, UDP is not. For example, I have a Cisco VPN client machine on the
internal net and when using UDP for encapsulation of ESP packets none
of the returning UDP packets are passed back to the Cisco VPN host (using
a hub and sniffer in front of the Screen's hme0 interface).  Although both
'ssadm lib/statetables' and ssadm lib/nattables' have the communication
properly listed; nothing is even logged as being passed or dropped on hme0
interface. Detailed logging is enabled for everything except broadcast &
NetBIOS type traffic.  If I switch the Cisco VPN client to use TCP for esp
encapsulation everything works.  I tried other udp communications like
ntp, but no luck. The only UDP that's works is DNS. Anyone have similar
experiences with Sunscreen? Maybe know the cause here and/or even a
solution?

Thanks in advance.

0
Techniq
10/11/2003 9:02:34 PM
comp.sys.sun.admin 3739 articles. 0 followers. bozothedeathmachine16 (49) is leader. Post Follow

0 Replies
386 Views

Similar Articles

[PageSpeed] 50

Reply: