This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

port forwarding set up webserver behind astaro

Hello,

I have spend several hours looking over all posts, and the kb article for port forwarding, forwarding to a web server  on the internal network.
Trying to set up just a simple working model to which I can modify later for other port forwards. I have many devices and systems with web management on sitting on my internal LAN.
I just installed the home use of Astaro Security Gateway v7 and now trying to set up all my port forwards.

The KB article instructions I tried is the first one:

Task:

    Require servers or systems behind the ASG to be accessible to internet connections.  This requires specific services to be forwarded through by opening service ports.

    Common implentations used are Webservers (HTTP, HTTPS) FTP servers, Remote Desktop Proctocol (RDP), Outlook Web Access (OWA)

    4 common scenarios to setup:

    Scenario 1 - Common port on public interface
    Scenario 2 - New service port creation needed to forward
    Scenario 3 - Additional public address
    Scenario 4 - Additional public address and new service port

Steps:
    For all scenarios it is recommended to first spend some time creating host definitions for webservers, email servers, ftp servers etc.
    Example: Webserver host definition
    Goto Definitions>>Networks
    New Network Definition
    Name: Webserver
    Type: Host
    Address: 10.200.200.10
    Comment: My internal webserver IP

    For all Scenarios it is also possible to simply select the option for auto packet filter rules to be applied if you do not wish to create the rule seperately.

    Scenario 1 - Common port on public interface
      Example: Webserver on HTTP TCP port 80

    1) Create a DNAT rule
    Goto Network Security>>NAT
    Select DNAT/SNAT tab
    New NAT rule
    Name: Webserver
    Group: No group
    Position: Bottom
    Traffic Source: Any
    Traffic Service: HTTP
    Traffic Destination: External (address)
    NAT Mode: DNAT (destination)
    Destination: Webserver
    Destination Service: left blank
    Click Save
    Once created click traffic light  from Red to Green

    2) Create Packet filter access
    Goto Network Security>>Packet filter
    Select Rules tab
    New Rule
    Group: no group
    Position: Bottom
    Source: Any
    Service: HTTP
    Destination: Webserver
    Action: Allow
    Time Event: Always
    Log traffic: off
    Comment: Allow http traffic to webserver
    Click Save
    Once created click traffic light  from Red to Green

I have one external I.P. assigned to the WAN port.
Internal address of the web server is 192.168.2.80

Do I need to set a definition? if so, is it to be set up in / under the  service or network area? Service already has http and https already set up.
Per several article posts, I tried what they suggested and I did try to create a network for the webserver. Right now there is no definition set up for network for the web server. between the posts and this kb article I did try playing with things to get it working with no luck.

under network security the DNAT/SNAT setting has:

name: webserver80
group: no group
position 1
traffic source: any
trafisc service: http
trafic destination: external  wan address
nat mode:  DNAT (Destination)
Destination: webserver - (this object is correctly set up with the correct I.P. internally)
Destination service: -left blank
log initial packets checked
automatic packet filter rule checked

The filter:

group: no group
it is position 6
source: any
service http
destination:  webserver (the object has the correct i.p. settings on it)
action: allow
traffic log checked

the live log shows:

16:21:55 Default DROP UDP
192.168.2.5 : 137
→
192.168.2.255 : 137

len=78 ttl=64 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:02:b3:65:7a:f8
16:22:07 DNS request UDP
192.168.2.254 : 44129
→
192.168.2.1 : 53

len=77 ttl=64 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:02:b3:65:7a:f8
16:22:08 DNS request UDP
192.168.2.254 : 39709
→
192.168.2.1 : 53

len=75 ttl=64 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:02:b3:65:7a:f8
16:22:32 Connection using NAT TCP
192.168.2.254 : 44327
→
64.22.199.118 : 80

[SYN] len=60 ttl=64 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:02:b3:65:7a:f8
16:22:33 Packet filter rule #5 TCP
192.168.2.254 : 44327
→
192.168.2.80 : 80

[SYN] len=60 ttl=63 tos=0x00 srcmac=00:02:b3:65:7a:f8 dstmac=00:02:b3:65:7a:f8
16:23:13 Default DROP UDP
192.168.2.80 : 123
→
173.8.198.243 : 123

len=76 ttl=63 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:02:b3:65:7a:f8
16:23:21 WebAdmin connection TCP
192.168.2.254 : 57209
→
192.168.2.1 : 4444

[SYN] len=60 ttl=64 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:02:b3:65:7a:f8

What am I doing wrong or missing?

What is the correct settings step by step to get this to work?
I want to be able to access the website from internal with the external address as well as access the website from outside(WAN).
I assume once I get one working port forward set up, I can model off it for any other port and service.

you would think port forwarding would be easy and simple.  Last time I worked with Astaro was around 3 1/2 years ago at my old job.

Chad

This thread was automatically locked due to age.

Parents

0 BarryG over 15 years ago

Hi,

Do you have masquerading setup already for your LAN(s)?

Since the firewall is NOT dropping the incoming SYN (connection attempt)
[SYN] len=60 ttl=64 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:02:b3:65:7a:f8 16:22:33 Packet filter rule #5 TCP 192.168.2.254 : 44327 → 192.168.2.80 : 80

it's likely that something on the webserver is not setup correctly, perhaps a software firewall?

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 cmp828 over 15 years ago in reply to BarryG

Hello,

All settings on the web server are working, I just replaced a small Linksys home router with the Astaro. All the port forwards and servers behind the Linksys worked. Just having difficulties figuring out the correct set of items to set and configure for the port forwarding on Astaro. The NAT in general is working. I have DHCP working fine, and all internal machines can reach the internet and everything is working and going out to the internet just fine.
The 5 computers have no issues going out to the Internet.

under network security I have only one NAT setting under Masquerading which was the default from the Astaro install.

network: internal
Interface External(WAN)
Use Primary address

so it is set for internal network to External WAN network

Then just the one entry in the DNAT/SNAT from my first posting. I am going to see if they have any videos on setting up a basic port forwarding.
I must be missing something some place???? Have to go buy more ink and complete printing out the Astaro manual.

Thank you for taking time to ask and respond.

Chad
Cancel
Vote Up 0 Vote Down

Cancel
0 cmp828 over 15 years ago in reply to cmp828

I don't know if this is affecting things.  I assume the port forwarding instructions might be a little old and not reflect the most current version of Astaro. found an article about the Any Service definition. See at the end of this for that article.

Encase that ANY was giving me some issues I changed it from any to Internet.

Packet filter:

group: no group
source: internet
service http
destination webserver - (has correct settings to point to it)
action : allow

my DNAT/SNAT   now is Internet to http to external WAN Address

my live log now shows this:
0:19:55 WebAdmin connection TCP
192.168.2.119 : 51703
→
192.168.2.1 : 4444

[SYN] len=60 ttl=64 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:02:b3:65:7a:f8
10:20:26 Default DROP TCP
222.215.230.49 : 12200
→
64.22.199.118 : 8000

[SYN] len=40 ttl=115 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:00:00:00:00:00
10:20:26 Default DROP TCP
222.215.230.49 : 12200
→
64.22.199.118 : 8080

[SYN] len=40 ttl=115 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:00:00:00:00:00
10:20:27 Default DROP TCP
222.215.230.49 : 12200
→
64.22.199.118 : 8800

[SYN] len=40 ttl=115 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:00:00:00:00:00
10:20:28 Default DROP TCP
222.215.230.49 : 12200
→
64.22.199.118 : 7212

[SYN] len=40 ttl=115 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:00:00:00:00:00
10:20:36 Default DROP TCP
192.168.2.119 : 49533
→
64.22.199.118 : 80

[SYN] len=60 ttl=64 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:02:b3:65:7a:f8
10:20:39 Default DROP TCP
192.168.2.119 : 49533
→
64.22.199.118 : 80

[SYN] len=60 ttl=64 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:02:b3:65:7a:f8
10:20:45 Default DROP TCP
192.168.2.119 : 49533
→
64.22.199.118 : 80

[SYN] len=60 ttl=64 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:02:b3:65:7a:f8

Any other thoughts and suggestions?
Chad

Product Version: 7.300 and above

Symptom:

    Firewall has DNAT/SNAT rules which specify the "Any" service definition in the Traffic Service field, and also specify something in the Destination Service field. Prior to 7.300, this rule was functioning, but after upgrading to 7.300, the rule is disabled. Re-enabling it fails, and highlights the Traffic Service field.



Cause:

    The Any service definition represents any packet, regardless of protocol. When specifying something as a destination service, and Any as the original service, this may be asking the device to translate packets between protocols, which is impossible. For instance, with the example rule below:

    Traffic Source: Any
    Traffic Service: Any
    Traffic Destination: External(Address)

    NAT Mode: DNAT

    Destination: Internal_Server
    Destination Service: HTTP

    The above example is only logical for TCP traffic, since the destination service is HTTP. However, the source section would also apply to ICMP ping packets, and the above rule is asking that they be translated to TCP port 80 packets, which is impossible.

Resolution:

    If you are specifying "Any" as the destination service, then click the orange recycle box icon to clear that field, and hit save. The rule can now be enabled, and will work as before.

    If you are specifying a destination port, you must create a new service to replace the use of Any.

    Service Type: TCP/UDP (Can also be just TCP or UDP if that is all that is needed)
    Destination Port: 1:65535
    Source Port: 1:65535
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 cmp828 over 15 years ago in reply to cmp828

I don't know if this is affecting things.  I assume the port forwarding instructions might be a little old and not reflect the most current version of Astaro. found an article about the Any Service definition. See at the end of this for that article.

Encase that ANY was giving me some issues I changed it from any to Internet.

Packet filter:

group: no group
source: internet
service http
destination webserver - (has correct settings to point to it)
action : allow

my DNAT/SNAT   now is Internet to http to external WAN Address

my live log now shows this:
0:19:55 WebAdmin connection TCP
192.168.2.119 : 51703
→
192.168.2.1 : 4444

[SYN] len=60 ttl=64 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:02:b3:65:7a:f8
10:20:26 Default DROP TCP
222.215.230.49 : 12200
→
64.22.199.118 : 8000

[SYN] len=40 ttl=115 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:00:00:00:00:00
10:20:26 Default DROP TCP
222.215.230.49 : 12200
→
64.22.199.118 : 8080

[SYN] len=40 ttl=115 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:00:00:00:00:00
10:20:27 Default DROP TCP
222.215.230.49 : 12200
→
64.22.199.118 : 8800

[SYN] len=40 ttl=115 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:00:00:00:00:00
10:20:28 Default DROP TCP
222.215.230.49 : 12200
→
64.22.199.118 : 7212

[SYN] len=40 ttl=115 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:00:00:00:00:00
10:20:36 Default DROP TCP
192.168.2.119 : 49533
→
64.22.199.118 : 80

[SYN] len=60 ttl=64 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:02:b3:65:7a:f8
10:20:39 Default DROP TCP
192.168.2.119 : 49533
→
64.22.199.118 : 80

[SYN] len=60 ttl=64 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:02:b3:65:7a:f8
10:20:45 Default DROP TCP
192.168.2.119 : 49533
→
64.22.199.118 : 80

[SYN] len=60 ttl=64 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:02:b3:65:7a:f8

Any other thoughts and suggestions?
Chad

Product Version: 7.300 and above

Symptom:

    Firewall has DNAT/SNAT rules which specify the "Any" service definition in the Traffic Service field, and also specify something in the Destination Service field. Prior to 7.300, this rule was functioning, but after upgrading to 7.300, the rule is disabled. Re-enabling it fails, and highlights the Traffic Service field.



Cause:

    The Any service definition represents any packet, regardless of protocol. When specifying something as a destination service, and Any as the original service, this may be asking the device to translate packets between protocols, which is impossible. For instance, with the example rule below:

    Traffic Source: Any
    Traffic Service: Any
    Traffic Destination: External(Address)

    NAT Mode: DNAT

    Destination: Internal_Server
    Destination Service: HTTP

    The above example is only logical for TCP traffic, since the destination service is HTTP. However, the source section would also apply to ICMP ping packets, and the above rule is asking that they be translated to TCP port 80 packets, which is impossible.

Resolution:

    If you are specifying "Any" as the destination service, then click the orange recycle box icon to clear that field, and hit save. The rule can now be enabled, and will work as before.

    If you are specifying a destination port, you must create a new service to replace the use of Any.

    Service Type: TCP/UDP (Can also be just TCP or UDP if that is all that is needed)
    Destination Port: 1:65535
    Source Port: 1:65535
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 cmp828 over 15 years ago in reply to cmp828

Hello,

I finally got my manual printed out, read over sections of definitions, Network and Network Security and the KB article on port forwarding.
I was able to pull an unsecured wifi signal for me to use to test my firewall from an external source.

I have managed to get port forwarding working for https, http, and ssl

all I did was work under the network security for policy and DNAT.

My webserver  or FTP server objects were correctly set up and with the I.P. and everything needed for it was already pre set. So when I go to put in destination and choose webserver or ftpserver that definition was already configured or you can create it on the fly.

for my HTTP port forward DNAT settings:
name: webserver1
group: no group
position:1
Traffic Source: any
Traffic Service: http
traffic destination: external (WAN) (address)
NatMode: DNAT
Destination: webserver
        (this was preset up with correct I.P. on my internal LAN on 192.168.2.80)

Destination Service:  left blank
I have log packets checked
Auto Filter rule is not checked.

Then my Packet filter rules is:

group: no group
position: 6
Source : any
Service : http
destination: webserver
action: allow
Log traffic checked.

The first attempt to just get things to work I had on dnat for traffic destination set to "any" as well and in destination service I had the "http". That worked fine from external Internet, but all my internal machines would automatically be pointed to my web server. Type in Yahoo! Deutschland on my internal machine and it would go to my webserver and not yahoo.

(per the manual if port forward https (port 443) you need to redirect the user portal setting to something else)

for my HTTPS port forward DNAT settings are :
name: webserver1
group: no group
position:1
Traffic Source: any
Traffic Service: https
traffic destination: external (WAN) (address)
NatMode: DNAT
Destination: webserver
        (this was preset up with correct I.P. on my internal LAN on 192.168.2.80)

Destination Service:  left blank
I have log packets checked
Auto Filter rule is not checked.

Then my Packet filter rules is:

group: no group
position: 6
Source : any
Service : https
destination: webserver
action: allow
Log traffic checked.

for my SSL (port 22)

for my SSL port forward DNAT settings:
name: webserver1
group: no group
position:1
Traffic Source: any
Traffic Service: SSL
traffic destination: external (WAN) (address)
NatMode: DNAT
Destination: webserver
        (this was preset up with correct I.P. on my internal LAN on 192.168.2.80)

Destination Service:  left blank
I have log packets checked
Auto Filter rule is not checked.

Then my Packet filter rules is:

group: no group
position: 6
Source : any
Service : SSL
destination: webserver
action: allow
Log traffic checked.

I still have web servers / web management interfaces on other servers and devices that I need to port forward. I have not had much luck yet with that.
I have a security camera system all web based set for port 8081. I tried to make a custom http-cpu1 for port 8081 and it does not seem to be working.

Anyway hope the above settings help everyone.  I am using the free home version running the v7.5 or latest update as of Feb.14,2010 that I had just updated to.

Chad
Cancel
Vote Up 0 Vote Down

Cancel