TCP/IP conflict with Firewall between Internal and External address

[ZulZurrander]

Running a small network with win98. Currently internal IP is 192.168.4.129, externall adress 64.113.2.53., externall is providing gateway to internet.

Problem is that with certain aplications, we are receving, "firewall detected" and unable to run aplication. Any recommendations.

 

[ZulZurrander]

DNS SERVER currently 64.113..., usually the error received is a "comflict error between internall and externall adress"

 

[pansophic]

What kinds of applications are you getting the warning with? Certain protocols, especially like H.32x (Voice or Video over IP) require that you have a protocol aware proxy, rather than a simple firewall. That is because they use a TCP protocol to set up a UDP connection between the two computers. When you use NAT, the address contained inside the TCP setup packets does not get changed, so they get your real IP address, 192.168.4.129 in the call setup message. Obviously, they can't actually find that address on the Internet, so they send you back a warning to that effect.

Another protocol that frequently exhibits this type of response is IPSEC. Your certificate gets associated with your actual IP address and can't be NAT'd. If you are a VPN client, it is usually OK, but if you are attempting to do Peer VPN connections, then you need a static, resolvable address.
pansophic

 

[ZulZurrander]

Thanks Pan,

As much as I hate to admit it, it is gaming software that is causing the issue. We can access the internet just fine, but when clients want to go to for example, gamespyarcade.com, is were we run into problems.

 

[pansophic]

I didn't even think about games. Many of them used a fixed source as well as destination port and make it impossible to connect more than a single host through a NAT'd router or firewall. You may want to run ethereal to determine if this is your problem or not, but the symptoms should be that you cannot have more than a single client connected to a given game at any given time.

Good luck!
pansophic

 

[ZulZurrander]

Thanks again, While I wait for ethereal results, any reccomendations. The client is a hard core gamer, He and a few of his coworkers are a little in the obssesed side. Any reccomendations on what I might be able to do?

 

[pansophic]

I helped a friend work around this kind of problem by putting a Linux firewall with multiple interfaces behind his cable modem. Then we got DHCP addresses from the ISP for each of the interfaces and statically NAT'd each of his computers through a different interface. It was kind of messy to set up, but it allowed him to run 3 simultaneous gaming sessions through his cable modem.

Personally, I'd tell them tuff, and force them to pay the ISP for the services that they will be consuming.
pansophic