I would guess you need to configure the HTTP Proxy and / or the client apps properly... I find that's the answer most of the time.It's the "properly" bit that's the hard part. From the documentation I've seen, there's no definition for how to do it properly. If an administrator has internalized how all of this stuff is supposed to work with respect to networking in general, and how it works with Astaro in particular, then maybe "properly" is sufficient. But based on the struggling I see, there's a lot of admins that don't have it all figured out!
Since the thread is for learners, let's presume that the install was done with the installation wizard, and the system has not strayed too far from that initial state. Certainly the basics are in place, but an HTTP Proxy is in effect (I think that's common).
1) Packet Filter Rules:
The first step I have seen offered is to open the packet filter live log (Logging > View log files > Packet Filter > live log), then try your application. If you see entries of [DROP], you need to create a rule (Network Security > Packet filter > New rule...).
2) Content Filter Rules:
Another step I have seen offered is to open the content filter live log (Logging > View log files > Content Filter (HTTP) > live log), then try your application. If you see entries of [action="block"], you need to adjust your content filter (Web Security > HTTP > Content Filter).
The problem comes with specifically what to do next when these steps have been taken (there are no "DROP" or "block" notices), yet the application still doesn't work. I have had several game and video sites where I have undertaken steps 1) and 2), but the applications still do not work.
3) Wide-Open Packet Filter with Logging
This technique, offered by RFCat_vk, will enable you to see more about what your application is doing when it works. The idea is to give it an easy time, temporarily, then use what you learn to do the proper configuration. First, create a packet filter rule with logging that allows all traffic (Network > Security > Packet Filter > New rule ... > Group: No Group, Position: Top, Source: Any, Service: Any, Destination: Any, Action: Allow, Log Traffic: checked > Save). Now open the live log for the packet filter (Logging > View log files > Packet filter > Live Log). Next go to your browser and reconfigure so that it no longer uses the HTTP Proxy, then hit the web site that's been giving you trouble (hopefully this will work for you). You now should see lots of stuff in the live log that you can use to see what your web page is actually trying to do. By the way, if you can't silence the rest of the network, it might be wise to create your packet filter as "Source:" then drop in just your test machine. When you are done, you will want to remove the test packet filter rule, of course.
4) Turn off Intrusion Protection
This will be enabled by default after the installation wizard. You might not want to leave it disabled, but you could try disabling it, then try your failing web site. To disable, you go to Network Security > Intrusion Protection > Global > Disable. IPS Status will turn red.
I would hope this thread gets more ideas for how to continue to "dig" and how to make additional adjustments to get applications working through the gateway, as well as specific questions for applications tried, observations, successes and failures.
--Dale--
This thread was automatically locked due to age.
