Subject: MBone and FireWall problem again.

From: Kyungsoon Park <[email-masked]>
Date: Thu, 11 Jan 1996 11:11:31 +0900

Hi,

I have no idea any more about this.
A firewall installed on our router, and I(203.255.112.9) made tunnel with
204.70.158.77(MCI).
I have tried below,

- open all UDP traffic(MCI told me)
- open all 224.x.x.x network traffic
- open only 161 port of UDP/TCP(some guy told me it's default port)

but these not work!. I cannot work with
         mtrace 204.70.158.77
It works correctly only when I open all of the firewall.
Can someone help me?
Thank you very much to all who tried to help me.  But sorry, I cannot solve
the problem.

Kyungsoon Park,
[email-masked]

---

From: Soonam Kahng <[email-masked]>
Date: Wed, 10 Jan 1996 23:40:48 -0500 (EST)

> - open only 161 port of UDP/TCP(some guy told me it's default port)

You need to open permit for 204.70.158.77 not for 224.x.x.x becasue
you are running "tunnel" wich is encapsulated packets and it's source
address is 204.70.158.77 not 224.x.x.x.

regards,

<Soonam>
[email-masked]

---

From: Jim Bogard BIX <[email-masked]>
Date: Thu, 11 Jan 1996 10:04:49 -0500 (EST)

> - open only 161 port of UDP/TCP(some guy told me it's default port)

That doesn't sound right- the source/dest IP of the tunnel traffic will 
be the tunnel endpoints... Plus igmp (Can't remember if that's UDP).

This works for me- we're using a cisco AGS+ as the firewall machine.

access-l 129 permit 4 128.244.xxx.xxx 0.0.0.0 0.0.0.0 255.255.255.255
access-l 129 permit igmp 128.244.xxx.xxx 0.0.0.0 0.0.0.0 255.255.255.255

The first line permits ip-in-ip (ip protocol 4) tunnel traffic through from 
our main mbone hub (128.244.xxx.xxx); and the second permits the igmp 
traffic.

Please email me if I can be of further assistance.

J-.
----
Jim Bogard  JHU/APL BIX Group             "This is my banjo.  There are many
Backbone Network Engineer                   like it, but this one is mine."

---

From: Matt Crawford <[email-masked]>
Date: Thu, 11 Jan 1996 10:04:15 -0600

> 204.70.158.77(MCI).  I have tried below,
> 

No, your MBONE tunnel does not use UDP.

> - open all 224.x.x.x network traffic

No, your MBONE tunnel uses unicast packets between your host and MCI's.

> - open only 161 port of UDP/TCP(some guy told me it's default port)

No, this is the port for SNMP.  Who told you this?

Your MBONE tunnel uses IP protocol 2 (IGMP) for the DVMRP routing
messages, and IP protocol 4 (IP-in-IP) for the data.  The most
restrictive filter you could use would be to allow those two
protocols (*protocols*, not ports!) between your MBONE router and
MCI's.
_________________________________________________________
Matt Crawford          [email-masked]          Fermilab
  PGP: D5 27 83 7A 25 25 7D FB  09 3C BA 33 71 C4 DA 6A

---

From: Graeme Wood <[email-masked]>
Date: Thu, 11 Jan 1996 17:27:01 +0000 (GMT)

> No, this is the port for SNMP.  Who told you this?

Forgive me but don't some versions of mrouted use SNMP, and so, therefore, 
you would need to open up access to this port if you wanted to allow 
people to connect and query mrouted?

[The mrouted SNMP port number is configurable I think so can be changed 
to another number if it conflicts with an already running snmpd.]

=============================================================================
Graeme Wood                                 Email: [email-masked]
Unix Systems Support                        Phone: +44 131 650 5003
The University of Edinburgh                 Fax:   +44 131 650 6552
-----------------------------------------------------------------------------
Scottish MICE National Support Centre       Email: [email-masked]
for your multimedia conferencing support    WWW:   http://mice.ed.ac.uk/mice/
=============================================================================

---

From: Magnus <[email-masked]>
Date: Thu, 11 Jan 1996 18:34:59 +0100

> people to connect and query mrouted?

Correct.

> to another number if it conflicts with an already running snmpd.]

The secondary port for mrouted SNMP is 9161 so this port has to be allowed as
well if your going to run mrouted SNMP, which I would recommend.

Remote debugging through SNMP is makeing life simpler give the rigth tools.

Magnus

---

From: "Mark L. Fausett" <[email-masked]>
Date: Thu, 11 Jan 1996 09:58:11 -0800

I'll bet they're filtering either ip protocol IPPROTO_IGMP (2) or
IPPROTO_IPIP (4)
or both; particularly since nothing much else uses them.

Good luck!

Mark Fausett
[email-masked]