I did a UDP port scan of voice .156 from an outside server using the command

nmap -sU -p 4567-4569 voice.txrx.org.uk

You will see that the scan to ports 4567 and 4568 are translated correctly to 192.168.100.20, but 4569 is not translated at all.

Also, my box .201 will be trying to make outbound connections to several servers on port 4569 (IAX)... Dunno if this is material.  I suspect something strange in the kernel of my Sveasoft box?  How can I establish what is going on?!

Rgds
Tim


RULE 9 -- DENY IN=vlan1 OUT=br0 PHYSOUT=vlan0 SRC=212.56.94.150 DST=192.168.100.201 LEN=28 TOS=0x00 PREC=0x00 TTL=36 ID=58373 PROTO=UDP SPT=44787 DPT=4568 LEN=8
RULE 9 -- DENY IN=vlan1 OUT=br0 PHYSOUT=vlan0 SRC=212.56.94.150 DST=192.168.100.201 LEN=28 TOS=0x00 PREC=0x00 TTL=36 ID=14681 PROTO=UDP SPT=44787 DPT=4567 LEN=8
RULE 9 -- DENY IN=vlan1 OUT=br0 PHYSOUT=vlan0 SRC=212.56.94.150 DST=192.168.100.201 LEN=28 TOS=0x00 PREC=0x00 TTL=36 ID=53305 PROTO=UDP SPT=44788 DPT=4568 LEN=8
RULE 9 -- DENY IN=vlan1 OUT=br0 PHYSOUT=vlan0 SRC=212.56.94.150 DST=192.168.100.201 LEN=28 TOS=0x00 PREC=0x00 TTL=36 ID=12712 PROTO=UDP SPT=44788 DPT=4567 LEN=8
RULE 6 -- DENY IN=vlan1 OUT= MAC=00:0f:66:d9:78:3a:00:d0:41:15:ee:60:08:00:45:00:00:28 SRC=212.56.94.150 DST=81.187.32.156 LEN=40 TOS=0x00 PREC=0x00 TTL=53 ID=0 DF PROTO=UDP SPT=4569 DPT=4569 LEN=20
RULE 6 -- DENY IN=vlan1 OUT= MAC=00:0f:66:d9:78:3a:00:d0:41:15:ee:60:08:00:45:10:00:28 SRC=68.43.103.58 DST=81.187.32.156 LEN=40 TOS=0x10 PREC=0x00 TTL=46 ID=0 DF PROTO=UDP SPT=4569 DPT=4569 LEN=20
RULE 6 -- DENY IN=vlan1 OUT= MAC=00:0f:66:d9:78:3a:00:d0:41:15:ee:60:08:00:45:10:00:28 SRC=68.43.103.58 DST=81.187.32.156 LEN=40 TOS=0x10 PREC=0x00 TTL=46 ID=0 DF PROTO=UDP SPT=4569 DPT=4569 LEN=20
RULE 6 -- DENY IN=vlan1 OUT= MAC=00:0f:66:d9:78:3a:00:d0:41:15:ee:60:08:00:45:10:00:28 SRC=68.43.103.58 DST=81.187.32.156 LEN=40 TOS=0x10 PREC=0x00 TTL=46 ID=0 DF PROTO=UDP SPT=4569 DPT=4569 LEN=20
RULE 6 -- DENY IN=vlan1 OUT= MAC=00:0f:66:d9:78:3a:00:d0:41:15:ee:60:08:00:45:10:00:38 SRC=68.43.103.58 DST=81.187.32.156 LEN=56 TOS=0x10 PREC=0x00 TTL=46 ID=0 DF PROTO=UDP SPT=4569 DPT=4569 LEN=36
RULE 6 -- DENY IN=vlan1 OUT= MAC=00:0f:66:d9:78:3a:00:d0:41:15:ee:60:08:00:45:00:00:28 SRC=212.56.94.150 DST=81.187.32.156 LEN=40 TOS=0x00 PREC=0x00 TTL=53 ID=0 DF PROTO=UDP SPT=4569 DPT=4569 LEN=20


Tim Robinson wrote:

> Hi Vadim --
>
> Problem is that the netmasks are different deliberately.
>
> The following IP addresses are assigned to my service from my ISP as follows:
>
>
> IP    Bits    Netmask     Usable addresses    Netname    Admin    Tech    Description
> 81.187.32.144    28    255.255.255.240    13    NULL    UKAA105021-RIPE UKAA105021-RIPE    Home network
>
> 81.187.32.178    Single address    NULL    UKAA105021-RIPE    UKAA105021-RIPE    Home network
>
> 81.187.67.133    30    255.255.255.252    1    NULL    UKAA105021-RIPE    UKAA105021-RIPE adsl router
>
> I am using the /30 for my ADSL router and the 'red' interface of my firewall, and the /28 block for my machines.  I have a static route in my ADSL router to route the /28 block to my WRT54G.
>
> So - the differing subnets are correct, and I do not think this is the cause of the problem...
>
> As regards the telnet session, I do get the translated IP address in the firewall log for telnet sessions, blocked at rule 9, but the IAX2 on port 4569/UDP is not picked up by the same rule that is translating the telnet session.
>
>
> RULE 6 -- DENY IN=vlan1 OUT= MAC=00:0f:66:d9:78:3a:00:d0:41:15:ee:60:08:00:45:00:00:28 SRC=212.56.94.150 DST=81.187.32.156 LEN=40 TOS=0x00 PREC=0x00 TTL=53 ID=0 DF PROTO=UDP SPT=4569 DPT=4569 LEN=20
>
> RULE 6 -- DENY IN=vlan1 OUT= MAC=00:0f:66:d9:78:3a:00:d0:41:15:ee:60:08:00:45:00:00:28 SRC=212.56.94.150 DST=81.187.32.156 LEN=40 TOS=0x00 PREC=0x00 TTL=53 ID=0 DF PROTO=UDP SPT=4569 DPT=4569 LEN=20
>
> RULE 9 -- DENY IN=vlan1 OUT=br0 PHYSOUT=vlan0 SRC=212.56.94.150 DST=192.168.100.201 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=24300 DF PROTO=TCP SPT=33667 DPT=23 WINDOW=5840 RES=0x00 SYN URGP=0
>
> RULE 9 -- DENY IN=vlan1 OUT=br0 PHYSOUT=vlan0 SRC=212.56.94.150 DST=192.168.100.201 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=24301 DF PROTO=TCP SPT=33667 DPT=23 WINDOW=5840 RES=0x00 SYN URGP=0