#-----------------------------------------------------------------------------#
#    This file contains forwarding rules, demonstrating how services (e.g.    #
#    pop3, smtp, ftp, ipsec, multimedia, etc) can be forwarded through the    #
#    firewall (to an internal PC).                                            #
#                                                                             #
#    To activate the rules, simply move them to firerule.cnf and update the   #
#    Mapping-Dest-IP to the IP address of your internal computer.             #
#                                                                             #
#    DISCLAIMER: Not all samples have been tested by F/X Communications.      #
#-----------------------------------------------------------------------------#


# Forwarding to an internal Web Server ---------------------------------------#

Portmap-WWW-In          Comment = "Running a WEB Server on an internal server (in)",
                        Destination = "my_ip",
                        Destination-Port = "80",
                        Rule-Action = Portmap,
                        Mapping-Dest-IP = "10.1.1.1",
                        Mapping-Dest-Port = WWW

Portmap-WWW-Out         Comment = "Running a WEB Server on an internal server (out)",
                        Source = "10.1.1.1",
                        Source-Port = "80",
                        Rule-Action = Portmap,
                        Mapping-Dest-Port = WWW


# An internal FTP Server -----------------------------------------------------#

Portmap-FTP-In          Comment = "Map FTP port 20 and 21 to internal PC (in)",
                        Destination = "my_ip",
                        Destination-Port = "21 20",
                        Rule-Action = Portmap,
                        Mapping-Dest-IP = "10.1.1.1",

Portmap-FTP-Out         Comment = "Map FTP port 20 and 21 to internal PC (out)",
                        Source = "10.1.1.1",
                        Source-Port = "21 20",
                        Rule-Action = Portmap,


# Running an internal SMTP (Mail) Server -------------------------------------#

Portmap-SMTP-In         Comment = "Map SMTP port 25 to internal PC (in)",
                        Destination = "my_ip",
                        Destination-Port = "25",
                        Rule-Action = Portmap,
                        Mapping-Dest-IP = "10.1.1.1",

Portmap-SMTP-Out        Comment = "Map SMTP port 25 to internal PC (out)",
                        Source = "10.1.1.1",
                        Source-Port = "25",
                        Rule-Action = Portmap,


# Running a POP3 (Mail) Server -----------------------------------------------#

Portmap-POP3-In         Comment = "Map POP3 port 110 to internal PC (in)",
                        Destination = "my_ip",
                        Destination-Port = "110",
                        Rule-Action = Portmap,
                        Mapping-Dest-IP = "10.1.1.1",

Portmap-POP3-Out        Comment = "Map POP3 port 110 to internal PC (out)",
                        Source = "10.1.1.1",
                        Source-Port = "110",
                        Rule-Action = Portmap,


# Forwarding all PPTP to one internal PC -------------------------------------#
#

Portmap-PPTP1-In         Comment = "Map incoming PPTP TCP connection to internal PC (in)",
                         Destination = "my_ip",
                         Destination-Port = "1723",
                         protocol = TCP,
                         Rule-Action = Portmap,
                         Mapping-Dest-IP = "10.1.1.1",

Portmap-PPTP1-Out        Comment = "Map outgoing PPTP TCP connection to internal PC (out)",
                         Source = "10.1.1.1",
                         Source-Port = "1723",
                         protocol = TCP,
                         Rule-Action = Portmap,

Portmap-PPTP2-In         Comment = "Map incoming PPTP protocol 47 to internal PC (in)",
                         Destination = "my_ip",
                         Protocol = 47,
                         Rule-Action = Portmap,
                         Mapping-Dest-IP = "10.1.1.1"

Portmap-PPTP2-Out        Comment = "Map outgoing PPTP protocol 47 to internal PC (out)",
                         Source = "10.1.1.1",
                         Protocol = 47,
                         Rule-Action = Portmap,


# Forwarding all IPSec to one internal PC ------------------------------------#
#
# If NAT-T is used, the Portmap-IPSec-In rule can be omitted.
#
# Check the documentation for more information.

Portmap-IPSec-In        Comment = "Map inbound IPSec (protocol 50) to internal PC",
                        Destination = "my_ip",
                        Protocol = 50,
                        Rule-Action = Portmap,
                        Mapping-Dest-IP = "10.1.1.1",

Portmap-IPSec-Out       Comment = "Map outbound IPSec (protocol 50) to internal PC",
                        Source = "10.1.1.1",
                        Protocol = 50,
                        Rule-Action = Portmap,

Portmap-IKE-In          Comment = "Map inbound ISAKMP (IKE negotiations) to internal PC",
                        Destination = "my_ip",
                        Destination-Port = "500 4500",
                        Protocol = UDP,
                        Rule-Action = Portmap,
                        Mapping-Dest-IP = "10.1.1.1",

Portmap-IKE-Out         Comment = "Map outgoing ISAKMP (IKE negotiations)",
                        Source = "10.1.1.1",
                        Source-Port = "500 4500",
                        Protocol = UDP,
                        Rule-Action = Portmap,


# SHIVA VPN Client -----------------------------------------------------------#
# Tested using the Shiva Smart Tunnel (SST) only.

Portmap-Shiva-Out       Comment = "Map Shiva VPN Client to internal PC (out)",
                        Source = "10.1.1.1",
                        Destination = "any",
                        Source-Port = "2233",
                        Rule-Action = Portmap,
                        Mapping-Dest-Port = 2233

Portmap-Shiva-In        Comment = "Map Shive VPN Client to internal PC (in)",
                        Source = "any",
                        Destination = "my_ip",
                        Destination-Port = "2233",
                        Rule-Action = Portmap,
                        Mapping-Dest-IP = "10.1.1.1",
                        Mapping-Dest-Port = 2233


# Running the dialpad telephony application (www.dialpad.com) ----------------#

Portmap-Dialpad-I1      Comment = "Map data to DialPad, port 51200 (in)",
                        Destination = "my_ip",
                        Protocol = UDP,
                        Destination-Port = "51200",
                        Rule-Action = Portmap,
                        Mapping-Dest-IP = "10.1.1.1",
                        Mapping-Dest-Port = 51200,

Portmap-Dialpad-I2      Comment = "Map data to DialPad, port 51201 (in)",
                        Destination = "my_ip",
                        Protocol = UDP,
                        Destination-Port = "51201",
                        Rule-Action = Portmap,
                        Mapping-Dest-IP = "10.1.1.1",
                        Mapping-Dest-Port = 51201,

Portmap-Dialpad-I3      Comment = "Map data to DialPad, port 51210 (in)",
                        Destination = "my_ip",
                        Protocol = TCP,
                        Destination-Port = "51210",
                        Rule-Action = Portmap,
                        Mapping-Dest-IP = "10.1.1.1",
                        Mapping-Dest-Port = 51210,


# Buddy phone (telephony application) ----------------------------------------#

Portmap-Buddy-In        Comment = "Map Buddyphone (in)",
                        Destination = "my_ip",
                        Destination-Port = "700:701",
                        Rule-Action = Portmap,
                        Mapping-Dest-IP = "10.1.1.1",

Portmap-Buddy-Out       Comment = "Map Buddyphone (out)",
                        Source = "10.1.1.1",
                        Source-Port = "701",
                        Rule-Action = Portmap,
                        Mapping-Dest-Port = 701,

Portmap-Buddy-Out2      Comment = "Map Buddyphone (out)",
                        Source = "10.1.1.1",
                        Source-Port = "700",
                        Rule-Action = Portmap,
                        Mapping-Dest-Port = 700,


# Running a Real Player (try without these rules first!) ---------------------#

Portmap-Real-In         Comment = "Map Real Player - Port 6970 UDP (in)",
                        Destination = "my_ip",
                        Protocol = UDP,
                        Destination-Port = "6970",
                        Rule-Action = Portmap,
                        Mapping-Dest-IP = "10.1.1.1",

Portmap-Real-Out        Comment = "Map Real Player - Port 6970 UDP (out)",
                        Source = "10.1.1.1",
                        Protocol = UDP,
                        Source-Port = "6970",
                        Rule-Action = Portmap,


# Running a DOOM Server ------------------------------------------------------#

Portmap-DOOM-In         Comment = "Map Doom Server, Port 666 UDP (in)",
                        Destination = "my_ip",
                        Protocol = UDP,
                        Destination-Port = "666",
                        Rule-Action = Portmap,
                        Mapping-Dest-IP = "10.1.1.1",

Portmap-DOOM-Out        Comment = "Map Doom Server, Port 666 UDP (out)",
                        Source = "10.1.1.1",
                        Protocol = UDP,
                        Source-Port = "666",
                        Rule-Action = Portmap,


# Running a Quake Server -----------------------------------------------------#

Portmap-Quake-In        Comment = "Map Quake Server, Port 26000 UDP (in)",
                        Destination = "my_ip",
                        Protocol = UDP,
                        Destination-Port = "26000",
                        Rule-Action = Portmap,
                        Mapping-Dest-IP = "10.1.1.1",

Portmap-Quake-Out       Comment = "Map Quake Server, Port 26000 UDP (out)",
                        Source = "10.1.1.1",
                        Protocol = UDP,
                        Source-Port = "26000",
                        Rule-Action = Portmap,


# Running a Quake2 Server ----------------------------------------------------#

Portmap-Quake2-In       Comment = "Map Quake Server, Port 27910 UDP (in)",
                        Destination = "my_ip",
                        Protocol = UDP,
                        Destination-Port = "27910",
                        Rule-Action = Portmap,
                        Mapping-Dest-IP = "10.1.1.1",

Portmap-Quake2-Out      Comment = "Map Quake Server, Port 27910 UDP (out)",
                        Source = "10.1.1.1",
                        Protocol = UDP,
                        Source-Port = "27910",
                        Rule-Action = Portmap,


# Gaming at the MSN Gaming Zone ----------------------------------------------#

Portmap-Zone-In         Comment = "Map The Zone - TCP Port 28800, 28912 (in)",
                        Destination = "my_ip",
                        Destination-Port = "28800 28912",
                        Rule-Action = Portmap,
                        Mapping-Dest-IP = "10.1.1.1",

Portmap-Zone-Out        Comment = "Map The Zone - TCP Port 28800, 28912 (out)",
                        Source = "10.1.1.1",
                        Source-Port = "28800 28912",
                        Rule-Action = Portmap,


Portmap-DirectX-In      Comment = "Map The Zone - DirectX 6.0 (in)",
                        Destination = "my_ip",
                        Destination-Port = "47624",
                        Rule-Action = Portmap,
                        Mapping-Dest-IP = "10.1.1.1",

Portmap-DirectX-Out     Comment = "Map The Zone - DirectX 6.0 (out)",
                        Source = "10.1.1.1",
                        Source-Port = "47624",
                        Rule-Action = Portmap,


# Gaming on Battle.net -------------------------------------------------------#

Portmap-Battle-In       Comment = "Map Battle.net - open TCP ports 116, 118 (in)",
                        Destination = "my_ip",
                        Destination-Port = "116 118",
                        Rule-Action = Portmap,
                        Mapping-Dest-IP = "10.1.1.1",

Portmap-Battle-Out      Comment = "Map Battle.net - open TCP ports 116, 118 (out)",
                        Source = "10.1.1.1",
                        Source-Port = "116 118",
                        Rule-Action = Portmap,


Portmap-Battle-In1      Comment = "Map Battle.net - open UDP port 6112 (in)",
                        Destination = "my_ip",
                        Protocol = UDP,
                        Destination-Port = "6112",
                        Rule-Action = Portmap,
                        Mapping-Dest-IP = "10.1.1.1",

Portmap-Battle-Out1     Comment = "Map Battle.net - open UDP port 6112 (out)",
                        Source = "10.1.1.1",
                        Protocol = UDP,
                        Source-Port = "6112",
                        Rule-Action = Portmap,


# Running ICQ - See also: http://www.icq.com/firewall/port.html --------------#

Portmap-ICQ-In          Comment = "ICQ - open ports 3989 through 4000 (in)",
                        Destination = "my_ip",
                        Destination-Port = "3989:4000",
                        Rule-Action = Portmap,
                        Mapping-Dest-IP = "10.1.1.1",

Portmap-ICQ-Out         Comment = "ICQ - open ports 3989 through 4000 (out)",
                        Source = "10.1.1.1",
                        Source-Port = "3989:4000",
                        Rule-Action = Portmap,


# Forwarding DTOC (Desktop On Call) to an internal client --------------------#
# must map the following port ranges
# http - usually port 80, but can be changed in properties
# 25345-25352


Portmap-DTOC-In         Comment = "Map DTOC port 80 on internal server (in)",
                        Destination = "my_ip",
                        Destination-Port = "80",
                        Rule-Action = Portmap,
                        Mapping-Dest-IP = "10.1.1.1",

Portmap-DTOC-Out        Comment = "Map DTOC port 80 on internal server (out)",
                        Source = "10.1.1.1",
                        Source-Port = "80",
                        Rule-Action = Portmap,

Portmap-DTOCData-In     Comment = "Map 25345-25352 requests to DTOC (in)",
                        Destination = "my_ip",
                        Destination-Port = "25345:25352",
                        Rule-Action = Portmap,
                        Mapping-Dest-IP = "10.1.1.1",

Portmap-DTOCData-Out    Comment = "Map 25345-25352 requests to DTOC (in)",
                        Source = "10.1.1.1",
                        Source-Port = "25345:25352",
                        Rule-Action = Portmap,

# Forwarding Napster to an internal client -----------------------------------#

Portmap-Napster-In      Comment = "Map Napster client (in)",
                        Source = "any",
                        Destination = "my_ip",
                        Destination-Port = "6697",
                        Rule-Action = Portmap,
                        Mapping-Dest-IP = "10.1.1.1",


Portmap-Napster-Out     Comment = "Map Napster client (out)",
                        Source = "10.1.1.1",
                        Source-Port = "6697",
                        Rule-Action = Portmap,


