Mailing List Archive

Hi,
I need to setup rsh via nat working.
Don't ask me why I use use unsafe protocol, and old kernel
2.6.13. I just need make them working.

I downloaded patch-o-matic, applied ip_conntrack_rsh patch to
kernel 2.6.13, rebuilt kernel , rebuilt iptables 1.3.3.

After reboot, I call "modprobe ip_conntrack_rsh". I applied
iptables rules from the netfilter webpage:


http://www.netfilter.org/projects/patch-o-matic/pom-extra.html#pom-extra
-rsh


I can see that conntrack is working, rsh stderr connection
initiated by rsh server is added to /proc/net/ip_conntrack_expected.
The problem is that the rsh stderr stream is not NAT'ed, and
connection fails.

Here is some trace from gateway:

eth2 - public interface of gateway.
10.0.236.90 - public IP of gateway
10.0.238.89 - IP of rsh server
192.168.40.51 - IP of rsh client

gateway:/ # tethereal -i eth2 host 10.0.236.90 and host 10.0.238.89
Capturing on eth2
0.000000 10.0.236.90 -> 10.0.238.89 TCP 1023 > shell [SYN] Seq=0
Ack=0 Win=5840 Len=0 MSS=1460 TSV=1927039256 TSER=0 WS=0
0.003846 10.0.238.89 -> 10.0.236.90 TCP shell > 1023 [SYN, ACK]
Seq=0 Ack=1 Win=5792 Len=0 MSS=1460 TSV=24463859 TSER=1927039256 WS=0
0.004107 10.0.236.90 -> 10.0.238.89 TCP 1023 > shell [ACK] Seq=1
Ack=1 Win=5840 Len=0 TSV=1927039261 TSER=24463859
0.004130 10.0.236.90 -> 10.0.238.89 RSH 1021\000
0.004180 10.0.238.89 -> 10.0.236.90 TCP shell > 1023 [ACK] Seq=1
Ack=6 Win=5792 Len=0 TSV=24463864 TSER=1927039261
0.005926 10.0.238.89 -> 10.0.236.90 TCP 1019 > 1021 [SYN] Seq=0
Ack=0 Win=5840 Len=0 MSS=1460 TSV=24463866 TSER=0 WS=0
0.005979 10.0.236.90 -> 10.0.238.89 TCP 1021 > 1019 [RST, ACK] Seq=0
Ack=0 Win=0 Len=0
0.006175 10.0.238.89 -> 10.0.236.90 TCP shell > 1023 [FIN, ACK]
Seq=1 Ack=6 Win=5792 Len=0 TSV=24463866 TSER=1927039261
0.006414 10.0.236.90 -> 10.0.238.89 TCP 1023 > shell [FIN, ACK]
Seq=6 Ack=2 Win=5840 Len=0 TSV=1927039263 TSER=24463866
0.006477 10.0.238.89 -> 10.0.236.90 TCP shell > 1023 [ACK] Seq=2
Ack=7 Win=5792 Len=0 TSV=24463866 TSER=1927039263

cat /proc/net/ip_conntrack
tcp 6 117 TIME_WAIT src=192.168.40.51 dst=10.0.238.89 sport=1023
dport=514 src=10.0.238.89 dst=10.0.236.90 sport=514 dport=1023 [ASSURED]
mark=0 use=1

cat /proc/net/ip_conntrack_expect ( cought by filtering out rsh server
initial connection of stderr stream)
1 proto=6 src=10.0.238.89 dst=10.0.236.90 sport=0 dport=1021

My questions are:
- how can I setup rsh connection via nat ?
- is it a problem with missing/incorrect iptables rules, or I
need ip_nat_rsh module?
- does ip_nat_rsh module exist?

I'll be gratefull for your help.

Regards,
Krzysztof