<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7036.0">
<TITLE>Firewall Issue Help request</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><SPAN LANG="en-au"><FONT SIZE=2 FACE="Arial">I've got a problem I've been trying to resolve for a day or so. We (Cisco and I) just added some configuration on a cisco router to allow certain users access to the internal network via Cisco VPN Client. The problem is now I need to adjust the firewall on the Linux server to allow for the CVPN users access. The remote users are on a 10.5.5.0/28 network when they log in. They need to access the LAN on192.168.5.0. So the setup goes like this:</FONT></SPAN></P>
<P><SPAN LANG="en-au"><FONT SIZE=2 FACE="Arial"> CVPN user 10.5.5.0/28</FONT></SPAN>
<BR><SPAN LANG="en-au"><FONT SIZE=2 FACE="Arial"> |</FONT></SPAN>
<BR><SPAN LANG="en-au"><FONT SIZE=2 FACE="Arial"> [cisco router] simple firewall</FONT></SPAN>
<BR><SPAN LANG="en-au"><FONT SIZE=2 FACE="Arial"> | 192.168.20.1 FE0</FONT></SPAN>
<BR><SPAN LANG="en-au"><FONT SIZE=2 FACE="Arial"> | 192.168.20.2 eth0</FONT></SPAN>
<BR><SPAN LANG="en-au"><FONT SIZE=2 FACE="Arial"> {linux server} major firewall</FONT></SPAN>
<BR><SPAN LANG="en-au"><FONT SIZE=2 FACE="Arial"> | 192.168.5.0/24</FONT></SPAN>
<BR><SPAN LANG="en-au"><FONT SIZE=2 FACE="Arial"> LAN</FONT></SPAN>
</P>
<BR>
<P><SPAN LANG="en-au"><FONT SIZE=2 FACE="Arial">#$IPT -t nat -A POSTROUTING -s 192.168.5.0/24 -o eth0 -j SNAT --to 192.168.20.2</FONT></SPAN>
<BR><SPAN LANG="en-au"><FONT SIZE=2 FACE="Arial"> # exempt the .5 network from PAT when destined to 10.5.5.0/28 network.</FONT></SPAN>
<BR><SPAN LANG="en-au"><FONT SIZE=2 FACE="Arial"> $IPT -t nat -A POSTROUTING -o $EXT_IFACE -s 192.168.5.0/24 -d 10.5.5.0/28 -j ACCEPT</FONT></SPAN>
<BR><SPAN LANG="en-au"><FONT SIZE=2 FACE="Arial"> $IPT -t nat -A POSTROUTING -o $EXT_IFACE -j MASQUERADE</FONT></SPAN>
</P>
<P><SPAN LANG="en-au"><FONT SIZE=2 FACE="Arial">I can get a connection to the router just cannot get any packets inside the LAN or on the external iface of the linux box, we can see packets on the internal iface of the router though.</FONT></SPAN></P>
<P><SPAN LANG="en-au"><FONT SIZE=2 FACE="Arial">Regards,</FONT></SPAN>
</P>
<P><SPAN LANG="en-au"><FONT SIZE=2 FACE="Arial">Jon</FONT></SPAN><SPAN LANG="en-us"></SPAN>
</P>
</BODY>
</HTML>