--- name: "plug-gw" section: "8" platform: "linux" package: "fwtk" version: "1.3-1" release: "Debian 1.3 (Bo)" platforms: ["linux"] url: "https://new.carta.tech/plug-gw" --- # plug-gw(8) generic TCP plugboard proxy ## NAME plug-gw - generic TCP plugboard proxy ## SYNOPSIS **plug-gw portnumber/name** \[invoked from inetd\] ## DESCRIPTION **plug-gw** provides pass-through TCP services with logging and access control for generic connection-oriented applications like NNTP. When **plug-gw** is invoked from **[inetd(8)](/inetd/8.md),** it reads its configuration and checks to see if the system that has just connected is permitted to use the proxy. If not, it shuts down and logs the connection. If the peer is permitted to use the proxy, **plug-gw** determines, based on its configuration, what host to connect to on the "other side". The service port **plug-gw** is servicing must be specified on the command line. ## OPTIONS **plug-gw** reads its configuration rules and permissions information from the firewall configuration table **netperm-table,** retrieving all rules specified for "plug-gw". The following configuration rules are recognized: - **timeout seconds** specifies a timeout value, after which to disconnect inactive connections. If no timeout is specified, the default is to remain connected until one side or the other closes its connection. - **port portid host-pattern \[options\]** specifies a connection rule. When a connection is made, a match is searched for on the port-id and calling host. The port-id may be either a numeric value (e.g.: 119) or a value from **/etc/services** (e.g.: "nntp"). If the calling port matches, then the host-pattern is checked for a match, following the standard address matching rules employed by the firewall. If the rule matches, the connection will be made based on the remaining options in the rule, all of which begin with '-'. Sub-options are: - **-plug-to host** specifies the name or address of the host to connect to. This option is mandatory. - **-privport** indicates that a reserved port number should be used when connecting. Reserved port numbers must be specified for protocols like **rlogin** which rely on them for "security." - **-port portid** specifies a different port. The default port is the same as the port used by the incoming connection. ## INSTALLATION To install **plug-gw** first place the executable in a system area, then modify **[inetd.conf(5)](/inetd.conf/5.md)** to install **plug-gw** for whatever services will be plugboarded. Reinitialize **[inetd(8)](/inetd/8.md)** and test by connecting to the port. **plug-gw** was designed to permit "tunnelling" NNTP traffic through firewalls, but it can be used for a variety of purposes such as permitting remote access to a single service on a single host. Typically, when configured for NNTP traffic, one configures one's software so that internal NNTP connections to the outside news server connect to the firewall and are automatically plugboarded to the external NNTP server, and vice versa. The USENET news software must then be configured so that both the internal and external NNTP servers believe they are exchanging news with the firewall machine. ## EXAMPLE - The following entries permit NNTP transfer through a firewall bastion host. In this example the interior news server host is "foo.us.org" (111.11.1.11) and the externam news server is "nntp.outside.someplace" (222.22.2.22). Our bastion host, where the software is installed is "bastion.us.org". On the bastion host, we place an entry for the NNTP service in inetd.conf: ``` nntp stream tcp nowait root /usr/local/etc/plug-gw plug-gw nntp ``` The plug gateway is invoked as "plug-gw nntp" to inform it that it is providing NNTP service. The configuration entries in netperm-table are as follows: ``` plug-gw: timeout 60 plug-gw: port webster 111.11.1.* -plug-to WEBSTER.LCS.MIT.EDU -port webster plug-gw: port nntp 111.11.1.11 -plug-to 222.22.2.22 -port nntp plug-gw: port nntp 222.22.2.22 -plug-to 111.11.1.11 -port nntp ``` Whenever 111.11.1.11 connects to the bastion host, it is automatically connected to 222.22.2.22's nntp service. The news software on 111.11.1.11 should be configured to believe that its news server is the bastion host "bastion.us.org", since that is the host to which it transfers and receives news. Note too that a simple webster service is provided by plugging webster on another host over the internet to the webster service port on the bastion host. ## FILES - **/etc/inetd.conf** **netperm-table** ## SEE ALSO [**netperm-table**(5)](/netperm-table/5.md) [**inetd**(8)](/inetd/8.md) ## BUGS Since incoming connection hosts can be wildcarded, **plug-gw** works well in a many-to-one relationship but does not work at all in a one-to-many relationship. If, for example, a site has 3 news feeds - it is easy to configure plug-gw to plugboard any connections from those 3 hosts to an internal news server, but unless there are multiple instances of **plug-gw** on different ports, and the internal news server's software can support connecting on a non-standard port, modification to software will be required.