web server in DMZ
I have a big problem
I have a web server in my DMZ, I reach it with his internal IP 192.168.1.10 from my internal LAN, but I can't reach them with his public IP.
I did a DNAT and from internet everythings is ok, my web server is working in right by DNAT.
Where is the problem?
_______________________________________
Connessione ed e-mail gratuita da 10 mb consultabile tramite web e tramite pop. www.infinito.it vieni a scoprire tutti i nostri servizi!
Quoted 10 lines · On Tue, 2004-09-28 at 06:21, [email protected] wrote:
I have a big problem
I have a web server in my DMZ, I reach it with his internal IP 192.168.1.10 from my internal LAN, but I can't reach them with his public IP.
I did a DNAT and from internet everythings is ok, my web server is working in right by DNAT.
Where is the problem?
<snip>
There could be several causes. Did you remember to bind the public address to the public firewall NIC so that it responds to ARP requests?
For example, if the firewall is at 1.1.1.2 and you want the web server to be at 1.1.1.3 then do
ip add address 1.1.1.3/24(or whatever the mask bit count is) dev eth0(or whatever the device name is) brd +
You can find a short slide show on using the ip command at
http://iscs.sourceforge.net
Good luck - John
Signature · 9 lines
John A. Sullivan III Chief Technology Officer Nexus Management +1 207-985-7880 [email protected] --- If you are interested in helping to develop a GPL enterprise class VPN/Firewall/Security device management console, please visit http://iscs.sourceforge.net
Quoted 10 lines · On Tue, 2004-09-28 at 06:21, [email protected] wrote:
I have a big problem
I have a web server in my DMZ, I reach it with his internal IP 192.168.1.10 from my internal LAN, but I can't reach them with his public IP.
I did a DNAT and from internet everythings is ok, my web server is working in right by DNAT.
Where is the problem?
are you asking how to connect to the web server from the inside by its public IP address? if so, you just need another DNAT rule, probably:
iptables -t nat -A PREROUTING -i $INSIDE_IF -p tcp -d $WWW_PUB_IP \
--dport 80 -j DNAT --to-destination 192.168.1.10-j
Signature · 1 line
Jason Opperisano <[email protected]>
Quoted 3 lines · On Tue, 28 Sep 2004 10:17:29 -0400 Jason Opperisano <[email protected]> wrote:
are you asking how to connect to the web server from the inside by its public IP address?
yes
Quoted 12 lines
if so, you just need another DNAT rule, probably:
iptables -t nat -A PREROUTING -i $INSIDE_IF -p tcp -d
$WWW_PUB_IP \ --dport 80 -j DNAT --to-destination 192.168.1.10-j
Signature · 1 line
Jason Opperisano <[email protected]>
well I think this is a very good solution, but I can't understand the following:
hosts in my LAN go in internet with a snat using x.x.x.50 ip address, and everythings is working; my web server is accessible from outside, then why my inside hosts can't access to him (with x.x.x.50 IP)? my hosts should see my web server like any web server on the net....right? what is wrong in this concept?
_______________________________________
Connessione ed e-mail gratuita da 10 mb consultabile tramite web e tramite pop. www.infinito.it vieni a scoprire tutti i nostri servizi!
Quoted 9 lines · On Tue, 2004-09-28 at 10:44, [email protected] wrote:
well I think this is a very good solution, but I can't understand the following:
hosts in my LAN go in internet with a snat using x.x.x.50 ip address, and everythings is working; my web server is accessible from outside, then why my inside hosts can't access to him (with x.x.x.50 IP)? my hosts should see my web server like any web server on the net....right? what is wrong in this concept?
routing. there's nothing "wrong" with the concept; it's just that when you want to alter how normal routing works, you need to understand it in order to break it.
-j
Signature · 1 line
Jason Opperisano <[email protected]>
Just create SNAT to that webserver so that whenever they try to go to the external address it get mangled and visible via its internal IP. Or you could play with advance routing wihch is a pain in this case.
Quoted 14 lines · Jason Opperisano
Quoted 4 lines · On Tue, 2004-09-28 at 10:44, [email protected] wrote:
well I think this is a very good solution, but I can't understand the following:
hosts in my LAN go in internet with a snat using x.x.x.50 ip address, and everythings is working; my web server is accessible from outside, then why my inside hosts can't access to him (with x.x.x.50 IP)? my hosts should see my web server like any web server on the net....right? what is wrong in this concept?
routing. there's nothing "wrong" with the concept; it's just that when you want to alter how normal routing works, you need to understand it in order to break it.
-j
Quoted 1 line · On Tue, 28 Sep 2004 08:14:54 -0700 Marek Dohojda <[email protected]> wrote:
Just create SNAT to that webserver so that whenever they try to go to the external address it get mangled and visible via its internal IP. Or you could play with advance routing wihch is a pain in this case.
I've just create a snat for my internal hosts so they go to outside with a public ip, but this solutions is not working.
_______________________________________
Connessione ed e-mail gratuita da 10 mb consultabile tramite web e tramite pop. www.infinito.it vieni a scoprire tutti i nostri servizi!
Quoted 10 lines · El mar, 28 de 09 de 2004 a las 12:21, [email protected] escribió:
I have a big problem
I have a web server in my DMZ, I reach it with his internal IP 192.168.1.10 from my internal LAN, but I can't reach them with his public IP.
I did a DNAT and from internet everythings is ok, my web server is working in right by DNAT.
Where is the problem?
If you have a public IP in the external NIC of your server then it should be working OK. I don't know if you want it to respond directly to Internet or via DNAT. Anyway it should work as you have it configured. Check the IP in the external NIC.
Signature · 12 lines
Jose Maria Lopez Hernandez Director Tecnico de bgSEC [email protected] bgSEC Seguridad y Consultoria de Sistemas Informaticos http://www.bgsec.com ESPAÑA The only people for me are the mad ones -- the ones who are mad to live, mad to talk, mad to be saved, desirous of everything at the same time, the ones who never yawn or say a commonplace thing, but burn, burn, burn like fabulous yellow Roman candles. -- Jack Kerouac, "On the Road"