MBONE-GW(8)

NAME
mbone-gw - MBone proxy

SYNOPSIS
mbone-gw [-daemon [port]]

DESCRIPTION
The Firewall Toolkit MBone proxy is an application level proxy that provides access control, authentication and logging mechanisms. The MBone proxy, which runs on the firewall, can be configured to allow users inside the firewall using specific MBone applications (sdr, vic, vat, wb, nt) to conference with users outside the firewall. In addition to configuring the MBone proxy on the firewall, client software also must be installed on all client systems which will use the MBone applications. You can configure the proxies to allow MBone conferencing based on:

•   source IP address

•   source host name

•   Multicast Group address

All packets, both incoming and outgoing, go to the firewall. On the firewall, the MBone proxy software listens for multicast group datagrams from the outside of the firewall and unicasts them to the inside client. The MBone proxy software also listens for unicast datagrams from the inside client and multicasts them outside the firewall. When the proxy multicasts outside, it also unicasts to other inside clients participating in the same conference. The proxy permits MBone multicast packets to reach only the inside client(s) requesting the specific multicast group traffic.

The MBone proxy (mbone-gw) generally runs as a daemon (invoked from /etc/rc.local) and listens for requests on a mbonesrv port (a new port indicated in /etc/services). Whenever the system receives a mbonesrv request on this port, the MBone proxy checks its configuration information (in the netperm-table) and determines whether the initiating host has permission to do MBone conferencing. If the host does not have permission, the MBone daemon logs the connection attempt and displays an error message.

If the host has permission, the proxy authenticates the user (if required), logs the multicast group, multicast port, MBone application and ttl (time to live) and starts forwarding the conference datagrams. The proxy remains active, forwarding MBone datagrams, until the inside client stops the MBone application, the timelimit is reached, or an error occurs.

The default configuration for the MBone proxy actually uses the network access control daemon (netacl) to start the proxy. This configuration allows the firewall to start the MBone proxy to handle MBone conferencing requests.

OPTIONS

  Command Line Options
The MBone proxy recognizes the following command line options (whether started from the command line or from within /etc/rc.local):

-daemon [port]
    Indicates that the MBone proxy runs as a daemon, and the port (name or number) on which the MBone proxy listens.

  Configuration Options
The MBone proxy reads configuration rules from the /usr/local/etc/netperm-table. It reads all rules using the mbone-gw and * (wildcard) keywords. The MBone proxy reads the netperm-table from top to bottom. If there are multiple rules in the table that could apply for a particular attribute, the MBone proxy uses the first one that it finds. See netperm-table(5) for a more complete explanation of netperm-table syntax and precedence.

The MBone proxy recognizes the following attributes:

authserver host port
    Specifies the host running the authentication server (and the port on which it runs) that the proxies use for authenticating users.

    host
        Specifies an IP address or host name.

    port
        Specifies a service name or port number.

denial-msg file
    Specifies the name of the file the MBone proxy displays when it denies access to a user because they do not have permission to use the MBone proxy. If no file is specified, the MBone proxy generates a default message.

denydest-msg file
    Specifies the name of the file the MBone proxy displays when it denies access to a user because they are trying to access a multicast group that they are not permitted to access. If no file is specified, the MBone proxy generates a default message.

hosts host-pattern [host-pattern2...] [options]
    rules specifying host and access permissions. Typically, a hosts rule will be in the form of:

    mbone-gw: deny-hosts unknown
    mbone-gw: hosts 192.33.112.* 192.94.214.*

    -auth operation
    -authall specifies that the proxy should permit no operation until the user has authenticated to the server.

    -authsdr
    specifies that the proxy should permit no operation until the user has authenticated to the server, unless the user has already authenticated when starting SDR.

    -dest pattern
    -dest { pattern1 pattern2 ... }
    specifies a list of valid multicast group addresses. If no list is specified, all multicast groups are considered valid. The -dest list is processed in order as it appears on the options line. -dest entries preceeded with a '!' character are treated as negation entries. Therefore the rule:

    -dest !224.2.200.* -dest *

    will permit joining conferences that are not in the 224.2.200.* multicast address range.

directory directory
    Specifies the directory that the MBone proxy makes its root directory before providing service. This option is equivalent to the chroot option in previous versions.

groupid group
    Specifies the name of the group the MBone proxy uses when running.

    group
        Specifies either a name or numeric id from the /etc/group file.

timelimit seconds
    Specifies the number of seconds the MBone proxy is to remain active (with network activity).

timeout seconds
    Specifies the number of seconds the MBone proxy is idle (with no network activity) before disconnecting.

userid user
    Specifies the user ID the proxy uses when running.

    user
        Specifies either a name or numeric id from the /etc/passwd file. This option is equivalent to the -user command in previous versions.

EXAMPLES
This example shows the configuration lines in the netperm-table that denies 224.2.200.30 as a destination and sets the name of the file that the MBone proxy displays when users try to access this site:

    #deny ftp.bigu.edu as a destination (by IP address)
    mbone-gw: deny-destination 192.168.1.100

    #file to display when users try to access a denied site
    mbone-gw: denial-msg /usr/local/etc/mbone-deny.txt

FILES

/etc/rc.local
    Command script that controls automatic reboot, and includes startup information for the MBone proxy.

/usr/local/etc/netperm-table
    The network permissions file contains configuration information for the Firewall Toolkit, including the MBone proxy.

BUGS
Report bugs to fwtk-support@tis.com or fwtk-users@tis.com. example, explaining what you expected to happen and what actually happened. Be sure to indicate the type of system (operating system, hardware, etc.) you are using, as well as the version of the MBone proxy.

AUTHOR
Trusted Information Systems, Inc.

SEE ALSO
netperm-table(5), rc(8), authsrv(8), netacl(8)