[OpenAFS] OpenAFS server behind NAT?

Tue, 20 May 2003 11:28:23 -0400

Hi Noel:

I do not use NetRestrict.

And you just have to have the server side set in
/usr/afs/local.

Your NetInfo file

# NetInfo
1.2.3.4
f 192.168.1.1

seems OK.  I am assuming that the 1.2.3.4 is the REAL IP
address of the fileserver machine.

And then 192.168.1.1 is the dedicated fake IP address
that the remote clients would use to get to your fileserver.

Thanks

Todd

                      "Noel                                                                                                   
                      Burton-Krahn"            To:       Todd DeSantis/Pittsburgh/IBM@ibmus                                   
                      <noel@bkbox.com>         cc:       <openafs-info@openafs.org>                                           
                                               Subject:  Re: [OpenAFS] OpenAFS server behind NAT?                             
                      05/20/2003 10:40                                                                                        
                      AM                                                                                                      

Thanks for the tip, Todd.  So, let me confirm.  If my NAT firewall has
address 1.2.3.4, and it forwards to my AFS server at 192.168.1.1, then my
NetInfo should be:

# NetInfo
1.2.3.4
f 192.168.1.1

and should I have an empty NetRestrict?

Should these files be exactly the same in /usr/afs/etc and /usr/vice/local?

Thanks again,
Noel

----- Original Message -----
From: "Todd DeSantis" <atd@us.ibm.com>
To: "Noel Burton-Krahn" <noel@bkbox.com>
Cc: <openafs-info@openafs.org>
Sent: Tuesday, May 20, 2003 6:09 AM
Subject: Re: [OpenAFS] OpenAFS server behind NAT?

>
>
>
>
> Hi -
>
> Many sites are using AFS behind NAT firewalls.
>
> As Derrick mentioned, you need to utilize the NetInfo
> file on your AFS fileserver.
>
> The NetInfo file on the fileserver should contain at
> least 2 entries
>       - the real IP
>       - the (NAT) fake IP, preceded by an "f" for fake
> This will allow the fileserver to register both IPs in
> the VLDB and allow clients a path to the fileserver regardless
> of which side of the NAT they are on.
>
> You should also NOT use ifconfig to advertise the fake IP.
> I have heard that this will cause the NAT to not work.
>
> So the NetInfo on the fileserver should be
>
> <real.ip>
> f <fake.ip>
>
> The real IP should be listed first so that all volserver
> admin work can take place on the inside of the NAT.  Most,
> if not all volserver commands will only work on the first IP.
> Having fileservers on either side of the NAT and expecting
> "vos release" to work across the NAT is not an easy thing
> to get working, so you will want to stay away from this type of
> setup.
>
> Restart the fileserver and it should register itself in the VLDB.
>
> You can determine if the VLDB has both IPs by doing
>
> # vos listaddrs
>
> and this command will list the addresses registered for all
> fileservers.
>
> The remote clients should have the Database Server's "fake ip" listed
> in their /usr/vice/etc/CellServDB so they know how to get to the
> vlservers for location information.
>
>
> Thanks
>
> Todd
>
>
>
>
>
>                       "Noel Burton-Krahn"
>                       <noel@bkbox.com>           To:
<openafs-info@openafs.org>
>                       Sent by:                   cc:
>                       openafs-info-admin@        Subject:  [OpenAFS]
OpenAFS server behind NAT?
>                       openafs.org
>
>
>                       05/19/2003 01:39 AM
>
>
>
>
>
>
>
> Anyone set up an AFS server behind a NAT firewall?   I've had no luck in
> the
> archives.  Here's my setup:
>
> I've got an AFS server with a 192.168 address behind a NAT firewall with
a
> real IP.
>
> Internet
> |
> |
> NAT firewall
> ip.real
> |
> |
> AFS server
> 192.168.1.1
>
> First problem: AFS reports its 192.168.1.1 address to clients, who of
> course
> can't connect back.  I fixed that by putting the real IP in NetInfo and
the
> fake in NetRestrict.  I also had to add a fake interface on the AFS
server
> with the real IP address
>
> # /usr/afs/etc/NetInfo
> ip.real
>
> # /usr/vice/local/NetRestrict
> 192.168.1.1
>
> # set up fake interface on AFS server with real IP
> ifconfig eth0:0 ip.real
>
> Now I look at both machines
> fs getclientaddrs
> fs getserverprefs
>
> and they have only the real IP, good!
>
> But, listing my behind-the-fireall AFS server still hangs forever on a
> remote client.  I've checked out a tcpdump on both client and server
while
> the client is hung.  I see that both sides are exchanging afs3-fileserver
> and afs3-callback traffic, but the client is missing some fileserver
> responses.
>
>
> Help!  Is there any way to get an AFS server working behind a NAT
firewall?
>
> Noel Burton-Krahn
> noel@bkbox.com
> 250-382-8767
>
> BKbox - The total remote office solution
> http://www.bkbox.com
>
>
> _______________________________________________
> OpenAFS-info mailing list
> OpenAFS-info@openafs.org
> https://lists.openafs.org/mailman/listinfo/openafs-info
>
>
>
>