FAO Matt:
In furtherance to my previous response to you, I have had my brain battered by trying to understand the seemingly impenetrable text relating to telnet that you posted for me. I was getting absolutely nowhere, with things not working as I followed them from the text. There is a lack of specificity which presumes someone knows what they are doing, already has certain knowledge - which I don't. I was just trying your commands at the C: prompt, not knowing I had to first telnet into the router, nor how to do that when I figured out I had to do that first. I have, however, managed to finally figure out how to telnet
exactly (i.e. the actual, specific text required to be input at the command prompt to actually telnet into the router). Then I was able to follow your text to a point ... actually. lol
So, before I go on, thank you very much for posting it and enabling me to feel that I have got somewhere. I really appreciate you making it available to me.
I still don't know what you mean by the specification of 'internal' and 'external' ports when the router interface does not give such an option. It only gives 'port range'. My following of your guide, then, may be incorrect as you ask to check that both internal and external ports are correct. As an example, where you say:
| Quote |
Telnet :service host list name="My Server"
Check that the application is defined correctly (protocol, external port, internal port). |
Each port I have forwarded in the router is listed like this:
Port 9100 for protocol tcp will be forwarded to host port 9100 Mode inbound
Port 9100 for protocol udp will be forwarded to host port 9100 Mode inbound
I have no idea if that means they are internal and external and could only presume that they do, so proceeded with your guide.
Regarding:
| Quote |
Telnet :nat maplist
Check that the public IP address and port is mapped to the correct internal IP address and port |
It seems to be so, but right in the middle of the maplist there is an entry that concerns me.
'8 NAPT Internet 87.113.65.73:51005 127.0.0.1:51005
0'
I know what 127.0.0.1 is, but being so technically unsavvy, I don't know if this entry means something worrisome. Does it mean there is some hole in my router configuration? Port 51005 open? I didn't configure any forwarding for this port number.
Also, at the end of the maplist is this:
'17 NAPT Internet 87.113.65.73 unmapped
5.'
Is that a problem?
When it came to this in your guide:
| Quote |
Telnet :firewall rule list chan=forward_host_service
Check that the firewall is configured correctly to forward the external ports to the internal IP address (in hexadecimal) and that the action is 'allow'. |
I got an error "chan unknown command", so I don't know what's going on there. I was, however, able to simply figure out that ':firewall rule list' was like a file path, so simply cut out the 'chan=forward_host_service' part from the input and scrolled down in the resultant listing to seek out the 'forward_host_service' items.
The entries look like this:
' 7 CDE map_6_9100-9... : accept
: map_6_9100-9100:9100-9100 *.* > *.map_6_9100-9100:C0A80140
8 CDE map_17_9100-... : accept
: map_17_9100-9100:9100-9100 *.* > *.map_17_9100-9100:C0A80140'
I can only presume this means forward external ports to internal IP address (the Hex value matches, I was able to find out via googling, my internal IP address). I would guess map_6 and map_17 refers to udp and tcp. All ports forwarded are set to 'accept', not 'allow' as your guide says. I guess it means the same thing, but thought best to mention it just in case it doesn't mean the same thing.
Now, regarding this from your guide:
| Quote |
In a web browser load the page http://www.t1shopper.com/tools/port-scan/
Your IP address should already be listed, type in the port 1234 and press the 'Scan Now' button.
In Wireshark you should see a SYN packet from an external IP address.
If you see the packet then your server is not configured correctly.
If you don't see a SYN packet then we need to run further tests. |
This doesn't make sense. 'You
should see a SYN packet' and 'If you see the packet then your server is not configured correctly. Surely if one SHOULD see a SYN packet, then it IS configured correctly. This just confused me. In either event I stopped here. I did see what I
think is a SYN packet in the top pane of wireshark, and from an external source when running the test. The website also said:
"87.113.65.73 isn't responding on port 9100 (jetdirect)."
I stopped here because your guide said seeing the SYN packet means my server isn't configured correctly.
Out of interest, another member kindly posted a heavy guide to the Thompson firewall settings which has really mangled my head. Anyway, through it I was able to test disabling it via telnet. Having done that, I tested again at the T1 site and still got the 'isn't responding' message, which implies that the firewall is still running, I guess. I also tested at GRC and passed the test, again, implying the firewall is still running. I don't know. Can you enlighten me?
