conduits

[staboogie]

Anyone know how to delete conduits using 5.2(6) on a 506 firewall. Also, what's the best way to allow a machine from outside to get to one server on the inside.

 

[baddos]

no conduit .....

Or you can blow out all conduits by doing a clear conduit.

You should make access-lists though, they are much faster.

Example showing access to a webserver on your network.

access-list 101 permit tcp any host 192.168.1.1 eq 80
access-group 101 in interface outside

This would allow packets from the outside interface to go to the webserver 192.168.1.1 over TCP port 80.

-Bad Dos

 

[staboogie]

I did roughly the same (had to use the conduit though), now the box can be pinged from the outside, but not ftp'd into or any other connection.

 

[baddos]

show your conduits, access-lists, and outbound lists.

-Bad Dos

 

[staboogie]

I'm sorry, I'm not sure what you mean. My problem is that I have no proof that the static has actually worked because even if I turn the machine off, I can ping it and get replys back. I'm running FOS 5.2(6), is the version too old or something?

 

[yizhar]

HI.

> I have no proof that the static has actually worked because even if I turn the machine off, I can ping it and get replys back
That's OK. I've seen that behavior in other pix implementations.
The pix is actually answering the ICMP on behalf of the internal host.
I don't know if this is good or bad, but your static works.
You should make the test using FTP client or TELNET to port 21 to see the real host.

The coduit command is like this:
conduit permit tcp host myserver eq ftp host remoteclient
myserver = the registered ip address specified in the "static" command.

If you're using nonstandard ftp port (other then 21), you should also add:
fixup protocol ftp ...

NOTE: the order is reversed versus access-list. In conduit the destination "global" address and port are first, then the originating "foreign" source address.
Some links:

http://www.cisco.com/warp/public/707/28.html

http://www.cisco.com/warp/public/110/pix_command_ref.shtml

http://teachers.sivan.co.il/yizhar#pixcript

Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar