Text 6, 128 rader
Skriven 2004-03-04 19:16:10 av Peter Knapper (3:772/1.10)
      Kommentar till text 2 av Mike Luther (1:117/3001.0)
Ärende: Privoxy - Ijfire help?
==============================
Hi Mike,

Mucho chopped...

 PK> All devices are network 192.168.1.x  mask 255.255.255.0

 PK>       to ISP
 PK>         |
 PK>        RTR .2 (inside)
 PK>         |
 PK>         +-------+-------+----> LAN
 PK>         |       |       |
 PK>         A       B       C
 PK>         .11     .12     .13

 ML> Yes.  And that LAN also includes, as well COAX as needed.

At the IP Level, it doesn't matter of its COAX, UTP, Fibre or wireless  they
are all the same. What CAN matter is any intelligent BRIDGING between the Media
types that may perform more than simple bridging, but I doubt that is an issue
here.


 PK>  - RTR points to the DNS Server on Host A, then ISP 1, 
 PK> then ISP2. It provides no DNS Services, it only USES 
 PK> the DNS (if it needs it).

 ML> Sort of.   But blows up if 127.0.0.1 is behind an Injoy 
 ML> software firewall,

??? The address 127.0.0.1 can exist on ALL hosts, you should not be feeding
that address FROM a DNS, the address should NOT be mapped to any external name
off the system performing the query.


 ML> As seems and is in the 
 ML> documents for both Injoy firewall and ZyXel, REVERSE 
 ML> DNS action requests may cause problems if you as for 
 ML> numeric service!  

Reverse lookups can be a trap, many services on the internet use them to
confirm the origin of someone requesting a session start. Most ISP's provide a
reverse entry for all IP adddresses that THEY assign from their DHCP, or PPP
pools. Anyone can build a forward address pointing to an IP, however only the
OWNER of that Network address block can provide a VALID reverse entry. This
should not cause any general problems though...


 ML> In my case most of the boxes need to be able to work 
 ML> not only behind the ZyXel, but on demand with the Injoy 
 ML> dialer as POTS and for more than one IP source if 
 ML> needed that way.  

If this is Outbound access, why do those machines need to use dialup access, is
it for private IP networking?

 ML> That doesn't lend itself to 127.0.0.1, no?

The Loopback address has (or SHOULD have) no relationship to anything outside
THAT machine, so I can't see how it applies. An established dial-up connection
should effectively create a default route VIA the modem connection, however
there should still be a NETWORK Route remaining for the LAN connection. That
route table should remain in use until the Dial-up connection is broken, when
it should be restored.


 ML> In the case with each INJOY 
 ML> software FIREWALLED box, by God and Glory, there was 
 ML> still the old domain's nameserver primary and secondary 
 ML> routes in there and

 ML>                   ON TOP OF THE CORRECT ONES!

One thing I have noticed with IP 4.1 and later (the 32bit stack) is that it
builds HOST ROUTES for the duration of a connection, and they get dropped after
a timeout. This contrasts with IP 4.0 (the 16bit stack) that did not do this. 

Do a NETSTAT -R, and a Network route will have a FLAG of UC. Your default
gateway will have a FLAG of UGSP. Ping your ISP's web server and you will find
a new HOST route with a FLAG of UGHW3 for the web server. All these routes
(except for the NETWORK Route) will have a gateway of the CURRENT DEFAULT ROUTE
off that machine. 


 ML> Answer; there is yet another RESOLVE file in there.  In addition to the 
 ML> customary "RESOLV2" there is also a "RESOLV" file which 
 ML> isn't on any box that doesn't have the Injoy software 
 ML> firewall installed!  

I am pretty sure that Injoy creates RESOLVE for its own use, the OS/2 IP stack
does NOT use a RESOLVE file, it uses RESOLV2.

 ML> My guess is that the installation of the Injoy firewall 
 ML> put it there based on the then-known parameters of the 
 ML> Injoy DOIP dialer, and it never gets changed or checked 
 ML> after that.

I vaugely remember a discussion about this many years ago, as a "problem"
relating to Injoy, but I was sure it had been fixed... Maybe if you remove
(delete) the file it will get re-created using "current" settings???

 ML> I hand edited the "resolv" file to correct it for the 
 ML> current stuff. Instant success and everything is now 
 ML> working.  But what is everything?

Everything that Injoy needs to know...

 ML>    1.) PRIVOXY now works perfectly.  That though it didn't without
 ML>        the delay of one minute per URL hit, even though IJB it's
 ML>        predecessor doesn't have the 'defect'.  Why?

 ML>        Yet under no circumstances would MOX, IWB or NS4.61 work
 ML>        with PRIVOXY as the proxy server with either alpha or
 ML>        numeric 'addressing' in the title bar.  Why?

I am starting to suspect that IJ Firewall may be involved in all items 1-4.

Test this theory with -
  De-install IJFire, 
  Remove RESOLVE, 
  Re-install IJFire,
and IJFire should re-create RESOLVE.

Cheers.........pk.


--- Maximus/2 3.01
 * Origin: Another Good Point About OS/2 (3:772/1.10)