This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Web server in internal network

All right, I want to run a web server on a machine in the internal network that is accessible from the outside. (I've already got one that runs in the DMZ, and the rule for this one will be turned on and off as needed) I want all of the traffic that comes in on port 80 to be directed to my DMZ server, and that is already set up and working.

For the internal server, then, I want to use a port like 8080. I've set up a new service named "Internal Web":
"Internal Web"  TCP  1024:65536  8080  "static"

I've added the internal server to the hosts.

I've added the NAT rule:
"Internal Web Server"  ::no match::->External(address) / Internal Web  none  /HTTP

And I've set up the Packet Filter rule:
  Any  Internal Web  Allow

But I still get a "cannot find server" error when I tell the browser to go to "http://:8080". Any suggestions on what I'm missing, etc? (And yes, I do have the web server running on the internal server)

This thread was automatically locked due to age.

Parents

0 bce over 21 years ago

ok dude - here it comes

[ QUOTE ]

I've added the NAT rule:
"Internal Web Server"  ::no match::->External(address) / Internal Web  none  /HTTP

[/ QUOTE ]

so if i understand this right - your internal server is listening to port 80 and you'll do a destination port translation, what means a packet from outside to port 8080 should be forwarded to the internal server on port 80, right?

so you have already added the rule

Any  Internal Web  Allow

but what about

Any http Allow  (for the destination port translation ;-) )

think this should fix your problem.

but hey dude, if you're running an apache in your dmz, one can add  a vhost with proxy so that your internal server could be reached on port 80, too. (you can run more server on one ip and one port)
Cancel
Vote Up 0 Vote Down

Cancel
0 MasterOfTheHat over 21 years ago in reply to bce

Okay, i'm confused...

I added this rule:
Any http Allow

And, yes, i already have a service defined. See original post.

In the Packet Filter section, but still no luck. It sounds like you're saying something about the NAT rule, but it doesn't fit into your post...
Cancel
Vote Up 0 Vote Down

Cancel
0 SecApp over 21 years ago in reply to MasterOfTheHat

I just had an idea: show me the screenshot of your DNAT rule. If you're on Windows, do an Alt Shift PrintScrn of the Browser, then go to Paint and do a Paste; save as JPG. Attach the file on a post here. (You can also try saving as HTML, but that can be problematic in terms of external dependencies...).

The internal Web Server you are not successfully routing to; isn't it listening on 80??
Cancel
Vote Up 0 Vote Down

Cancel
0 MasterOfTheHat over 21 years ago in reply to SecApp

well, i had deleted everything related to the internal server, so i was trying to go back and re-add everything. I came across this lovely error when trying to add the DNAT rule:
Error
Cancel
Vote Up 0 Vote Down

Cancel
0 bce over 21 years ago in reply to MasterOfTheHat

generally use "no match" instead of "any"
Cancel
Vote Up 0 Vote Down

Cancel
0 SecApp over 21 years ago in reply to MasterOfTheHat

Is Internal Web defined as 8080?
I'd like to see what's on the bottom part too...
Cancel
Vote Up 0 Vote Down

Cancel
0 MasterOfTheHat over 21 years ago in reply to SecApp

Updated link ^^
Cancel
Vote Up 0 Vote Down

Cancel
0 SecApp over 21 years ago in reply to MasterOfTheHat

That looks about right, except the Source should be Any;
but you say it won't let you enter that now??

P.S. Check this post going on in another forum right now:
Re: Need help with port forwarding
Cancel
Vote Up 0 Vote Down

Cancel
0 MasterOfTheHat over 21 years ago in reply to SecApp

I tried what was listed as a solution in that thread, but still no go...

After watching the Packet Filter log, it appears the packets are being dropped at the external interface. (the src is the sending machine and the dest is the external IP)_

And BTW, the reason i was getting an error when adding that rule was the result of a mistake when defining the service. I had accidentally chosen TCP/UDP instead of TCP.
Cancel
Vote Up 0 Vote Down

Cancel
0 MasterOfTheHat over 21 years ago in reply to MasterOfTheHat

AND WTF IS THIS? IF I TURN OFF THE RULES (NAT AND PACKET FILTER) FOR MY DMZ WEB SERVER, A STANDARD HTTP REQUEST TO MY DNS NAME RETURNS THE DMZ WEB SERVER'S PAGE?!?!?!?!?!?!?!?!?!?!?!!?!?!
Cancel
Vote Up 0 Vote Down

Cancel
0 SecApp over 21 years ago in reply to MasterOfTheHat

Are you running the http proxy??
Cancel
Vote Up 0 Vote Down

Cancel
0 RickS over 21 years ago in reply to MasterOfTheHat

Did you say your packet filter rule is:

Any/Internal Web -> Allow ->

If so, this is incorrect. Change Internal Web to HTTP. Natting happens before the packet filter in Astaro, so your packet filter should refer to the translated packet.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 RickS over 21 years ago in reply to MasterOfTheHat

Did you say your packet filter rule is:

Any/Internal Web -> Allow ->

If so, this is incorrect. Change Internal Web to HTTP. Natting happens before the packet filter in Astaro, so your packet filter should refer to the translated packet.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 BertJanssen over 21 years ago in reply to RickS

plz try to masq the internal network to the internal interface. [;)]

yup sounds stupid but just try it.
Cancel
Vote Up 0 Vote Down

Cancel
0 MasterOfTheHat over 21 years ago in reply to BertJanssen

SecApp: No HTTP Proxy
RickS: That's the rule i've already got set up
BERT: I'll try that and see... yes it does sound pretty stupid, but i'm up against a wall right now...
Cancel
Vote Up 0 Vote Down

Cancel
0 SecApp over 21 years ago in reply to MasterOfTheHat

Is the Internal Web Server's gateway set to Astaro??
Cancel
Vote Up 0 Vote Down

Cancel
0 SecApp over 21 years ago in reply to MasterOfTheHat

Just ruling something out: the Internal web server; you say in your posts above "DNS name"; have you acknowledged its name is in the Internet's DNS? (with an nslookup or a ping by name)
Cancel
Vote Up 0 Vote Down

Cancel