This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Server load balancing - not reachable from same subnet

I've got a fairly typical setup running Astaro 7.502 with an external subnet, DMZ and LAN.

Two webservers on the DMZ are loadbalanced (port 80/443).

The web servers are reachable both from externally and the LAN using the External web server IPs.

But if you try to use the external IP address to reach the web servers from the DMZ itself, the connection times out.

There are no packet drops logged in the firewall rules.

Any ideas on how to get this to work so we can take advantage of SLB from the same subnet?

Smells like a NAT issue to me, but I've tried the usual tricks without any success.

This thread was automatically locked due to age.

0 BarryG over 15 years ago

Hi Drees,
There was a discussion a few days ago which involved using Load Balancing internally as the solution to another problem:
https://community.sophos.com/products/unified-threat-management/astaroorg/f/53/t/32763

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 drees over 15 years ago

Hi Barry,

Thanks looking at the last post in that thread, it does seem that adding an additional internal IP to Astaro does seem like it would work.

But I was hoping to avoid having to use a split DNS setup.

I seem to recall that without the SLB Astaro would just magically "do the right thing" and reflect the connections back in - should that work in either case?
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 15 years ago

afaik, Astaro won't reflect traffic back into the same LAN.
Maybe turning off spoof protection would help, but I doubt it.

It does work if you have a DMZ; traffic from the LAN to the external address will forward to the DMZ. (default spoof protection enabled)

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 techuser over 15 years ago in reply to BarryG

Maybe turning off spoof protection would help, but I doubt it.

where is that ?
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 15 years ago in reply to techuser

where is that ?

Hi, in Astaro 7, there's a drop-down listbox under Network Security - PacketFilter - Advanced, in the middle of the screen.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 drees over 15 years ago in reply to BarryG

afaik, Astaro won't reflect traffic back into the same LAN.
Maybe turning off spoof protection would help, but I doubt it.

Weird - I swear that use to work at one point in time. But I tested it and it doesn't seem to work any more. I'll have to try turning off spoof protection...

It does work if you have a DMZ; traffic from the LAN to the external address will forward to the DMZ. (default spoof protection enabled)

Yes, that does work.
Cancel
Vote Up 0 Vote Down

Cancel
0 drees over 15 years ago in reply to drees

I'll have to try turning off spoof protection...

Nope - doesn't do anything.
Cancel
Vote Up 0 Vote Down

Cancel