Need help identifying ports needed to access a website.

Question

I am trying to access the following site:
Interactive mapping | City of Lawrence, Kansas
At the bottom of the page is a button that states "I agree with the above disclaimer".
When I press that button, I am redirected to this site:
http://ims03.ci.lawrence.ks.us:10002/iisstart.htm
I have added these rules:
Source Interface: All
Destination Interface: Public Interface
Packet Type: MapSite Out
Protocol: TCP
Source Port: 1024-65535
Destination Port: 10002
Source Address: All
Destination Address: 208.191.35.52
Source Interface: All
Destination Interface: Public Interface
Packet Type: MapSite In
Protocol: TCP
Source Port: 10002
Destination Port: 1024-65535
Source Address: 208.191.35.52
Destination Address: All
I get a "Loading the viewer" text message, but then eventually get a 504 Gateway TimeOut error.
If I drop the BorderManager Firewall...
unload ipflt
unload ipxflt
unload filtserv
then the site works just fine.
I just can't seem to get the filter exceptions correct for this site.
Any help would be appreciated.

Answer 1

In article <[email protected]>, Cadd wrote:
> Source Interface: All
> Destination Interface: Public Interface
> Packet Type: MapSite Out
> Protocol: TCP
> Source Port: 1024-65535
> Destination Port: 10002
> Source Address: All
> Destination Address: 208.191.35.52
>
This looks good. TCP packets with dest. Port 10002 will be allowed to
pass through BM only if they go from the private to the public
interface, and only if they are addressed to 208.191.35.52. So far so
good, but since you made this non-stateful, you have to add a return
exception. (Easier for you to make another exception, like '10002-st'
and just enable the stateful feature on it).
Your goal in the next exception is to allow the replies to these
outbound packets. Everything will be reversed in the exception for the
replies - interfaces, ports and addresses.
> Source Interface: All
> Destination Interface: Public Interface
> Packet Type: MapSite In
> Protocol: TCP
> Source Port: 10002
> Destination Port: 1024-65535
> Source Address: 208.191.35.52
> Destination Address: All
>
This one is the problem. It only allows the 10002 replies (source
port) from 208.191.35.52 if the reply is passing through the public
interface second. You did not reverse the interfaces. The packet
needs to go from public to private (or public to all if you have more
than one private interface). This exception is not allowing the return
in, which you would see if you have filter debug enabled looking at tcp
discards. You would see ACK packets with source port 10002 being
discarded.
Craig Johnson
Novell Support Connection SysOp
*** For a current patch list, tips, handy files and books on
BorderManager, go to http://www.craigjconsulting.com ***