This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Internal Web Server

Hello,

Need some help, as I'm not sure I get it....
I am hosting my own website, which I have configured successfully with DNAT and the filters.  I can access this website from the outside world with no problems.

From the LAN, I cannot access the site by using the FQDN; I get timeout errors.  I don't see anything in the filter logs being blocked for this.

I read the post the KB about this being an issue when using the http proxy.  I am not using the http proxy; it is disabled.  However, I added an local DNS entry in the Static DNS page anyways to try.  No Dice.  I am also providing my own DNS, so using internal / external DNS tricks won't work here unless I build another box to be an internal DNS server....seems like overkill for a routing issue.

How can I use a FQDN from the internal LAN via the normal DNS records?

Thanks for the help!

This thread was automatically locked due to age.

0 Scott_Klassen over 18 years ago

Need more details about your setup. Is the web server in a DMZ with its' address space in a separate subnet from your LAN? If so, you probably need to add a packet filter to allow web traffic from LAN to DMZ.

On the assumption that your using windows workstations, try doing an nslookup of the web server from inside the LAN. It should resolve to whatever internal DMZ IP address that it's been given. If it resolves to the external internet address assigned, then you probably have something wrong with your DNS setup and it won't work.

Did you setup any static routes?

These should hopefully get you started in the right direction for things to try and check for.

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel
0 inetmaster over 18 years ago in reply to Scott_Klassen

I am using windows. My network is a simple setup where the webserver is not (yet) in a DMZ, I only have one subnet for the entire private network.

I have DNAT and packet filter rules setup to allow incoming communication from the external interface to the webserver.

I do not have any static routes setup, but I do have a static DNS entry, which does not seem to help.
Cancel
Vote Up 0 Vote Down

Cancel
0 TXGARobert@Home over 18 years ago in reply to inetmaster

Quick question: Can you ping the webserver by IP address and/or by name from the local network?

Do you have a Windows server (2000/2003) running? Do you have a AD domain setup?
Cancel
Vote Up 0 Vote Down

Cancel
0 inetmaster over 18 years ago in reply to TXGARobert@Home

Quick question:  Can you ping the webserver by IP address and/or by name from the local network?

Do you have a Windows server (2000/2003) running?  Do you have a AD domain setup?

From my internal network I can ping it by the domain name, and receive replies from my external address.  Of course, I can also ping to the internal IP of the webserver as well.

This is a Windows 2003 server, but I am not using AD.

Again, outside my network all is well too.  I would just like to use www.mysite.com inside my network as well.

Thanks!
Cancel
Vote Up 0 Vote Down

Cancel
0 Scott_Klassen over 18 years ago in reply to inetmaster

Looks like the problem is that you only have an external A record for DNS. Since you only have an external DNS record with an internet IP address, when your clients try to access the website, the packets are leaving your LAN and then trying to loop back through the WAN interface.

For whatever internal DNS your internal LAN client machines are using (Astaro or Windows), you need to setup an A record pointing to that machine using the internal LAN IP. It's called split-DNS. One record for internal access, one record for external access. If your not using any consolidated internal DNS structure, you can always create an entry in the HOSTS file on each machine.

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel
0 VelvetFog over 18 years ago in reply to inetmaster

Again, outside my network all is well too. I would just like to use www.mysite.com inside my network as well.
Use split DNS. Run a local DNS server for the LAN workstations on your Windows server. Then you can create a DNS entry for your web server URL that points directly to its internal IP address.
Cancel
Vote Up 0 Vote Down

Cancel
0 Scott_Klassen over 18 years ago in reply to VelvetFog

I thought I just said that Velvet. [:P] You were probably clearer about it though. [:)] Probably just this silly board and it's need for manual page refreshes.

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel
0 VelvetFog over 18 years ago in reply to Scott_Klassen

Yes, when I started writing my item, yours wasn't listed.
Anyhow, inetmaster got basically the same advice from both of us.
Cancel
Vote Up 0 Vote Down

Cancel
0 inetmaster over 18 years ago in reply to VelvetFog

I did, and I thank you both.

Looks like split DNS it is....I have already put it in the works.

Thanks for your insight and help!

Inet
Cancel
Vote Up 0 Vote Down

Cancel
0 Scott_Klassen over 18 years ago in reply to inetmaster

NP, happy to help where and when I can.

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel