This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Beating my head against this NAT/DNAT issue

I have a web server on a local IP (192.168.1.22). It's public IP (67.177.108.222) is added as an additional address on Astaro's public interface. There is a DNAT rule that Translates ALL-HTTP-[67.177.108.222] to [192.168.1.22]. I then have a Packet Filter that allows ALL-HTTP-[192.168.1.22].

This works great for the outside world, but my internal NAT'd workstations cannot get this web page to load.

What am I missing?

This thread was automatically locked due to age.

Parents

0 eganders_01 over 17 years ago

If this is v.7, check your DNS settings in the Astaro. You can setup a redirect to the correct internal IP from those menus.
Cancel
Vote Up 0 Vote Down

Cancel
0 weeeezzll over 17 years ago in reply to eganders_01

Yes, it is version 7. I would prefer to not have to setup special static mappings to band-aid this problem. Shouldn't traffic be able to route normally out through NAT and then back through the firewall via DNAT?
Cancel
Vote Up 0 Vote Down

Cancel
0 eganders_01 over 17 years ago in reply to weeeezzll

Ummm, No. Can't make that U-Turn.
Cancel
Vote Up 0 Vote Down

Cancel
0 weeeezzll over 17 years ago in reply to eganders_01

So it either put the server in the DMZ (not an option for Windows servers IMHO) or create static mappings.

So I basically need an internal DNS structure that mimics the structure of my public DNS with the internal equivalents?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 weeeezzll over 17 years ago in reply to eganders_01

So it either put the server in the DMZ (not an option for Windows servers IMHO) or create static mappings.

So I basically need an internal DNS structure that mimics the structure of my public DNS with the internal equivalents?
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 eganders_01 over 17 years ago in reply to weeeezzll

DMZ???  This is not a DMZ setup.

No, they're not mappings any more than any DNS table is.  All you're doing is substituting the DNS entry you'd normally get from any external DNS server you happen to query, with a DNS entry from an internal DNS server (the Astaro).  In other words it's just an efficient replacement DNS entry for this one webserver (or more if you have more servers, etc.)

You're not remapping, you're telling your internal computers the quick and easy direct route to the local inside address of the webserver - the exact same IP address NATted external traffic will get routed to anyway.  Why make your IP traffic go out to the external address just to turn around and come right back in?

Setting it up this way also gives you faster access to your webserver and leaves your Astaro free to deal with other things.  It's a better way to go even if it were possible to route the traffic as you've suggested, which it's not.
Cancel
Vote Up 0 Vote Down

Cancel
0 WaMaR over 17 years ago in reply to eganders_01

I and many others have similar problems [:@]
https://community.sophos.com/products/unified-threat-management/astaroorg/f/54/t/38595
https://community.sophos.com/products/unified-threat-management/astaroorg/f/54/t/38581

ASG V7.011 have still Sorting Policy Route bug from V7.005 [:@]
https://community.sophos.com/products/unified-threat-management/astaroorg/f/54/t/38409

Configuration with NAT and Policy Routing works OK with V6 version. The same configuration with v7.011 version don't work. I have problem with routing from/to internal LANs and DMZs when I use privet and public IP for DMZ servers and Policy Routing for second Internet connection and this isn't DNS problem.

Version 7.011 don't work OK for production environment, have still serious bugs. If Astaro Support don't fix it I have to go back to version V6.

WaMaR
Cancel
Vote Up 0 Vote Down

Cancel