[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: iptables problem getting url's hosted inside

This is vary ploblematic as Gorge points out.  It's just best to be
avoided as setting up a DNS server is so easy.  apt-get install resolvconf
dnsmasq; # Is best way togo.

--- Douglas Maxwell <doug@turinglabs.com> wrote:
> On Tue, May 18, 2004 at 07:00:15AM -0500, hanasaki wrote:
> > external internet - firewall - internal web server
> > 
> > internet traffic on port 80 is passed to the internal web server
> > external internet based browsers can hit the server
> > inernal based browsers cannot
> > 
> > What iptables runs are needed to let the internal browsers hit the 
> > internal server with the external IP
> Could you post your NAT rules? iptables -L -t nat -nvx would do it.
> Also,
> a your iptables rules (maybe just the pertinent ones) with a snippet
> of iptables -L -nvx.
> In general, problems like this are usually caused by one of three
> things:
> 1) NAT is not being done properly
> 2) Asymmetric routing is causing the translated packets from your
> internal net to go out some odd interface, and never return.
> 3) The iptables ruleset is not configured to allow connections to your
> webserver with a source of your internal LAN (one related question -
> if you are doing SNAT for your internal network, this could also
> complicate things - you may have a rule that allows the internal net
> access to the webserver on port 80, but the packets are appearing on
> the firewall's external interface with the SNAT address you are using,
> causing the DROP/REJECT).
> A tcpdump on your firewall's external interface will tell you if you
> are inadvertently NAT'ing traffic from the internal LAN to the
> webserver. If you are logging all DROPs, you can also tail your syslog
> to see the packet details of the dropped packets.
> Doug
> -- 
> To UNSUBSCRIBE, email to debian-firewall-REQUEST@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact
> listmaster@lists.debian.org

Do you Yahoo!?
SBC Yahoo! - Internet access at a great low price.

Reply to: