Hello,
I am trying to set up my Astaro again after the CPU died. I have a new cpu and loaded and trying to put back all my settings. Sorry - no backups are available to use. I want to have it set so either from outside or from behind the Astaro on the LAN I can use the real I.P. or Name to access the webserver.
I thought full NAT took care of that and had it all working at one time.
I have a static I.P. now and a A record for my I.P. example: mycomputer.att.com
All computers are on the local LAN behind the Astaro. I want to be able to type in mycomputer.att.com from a computer on the local lan and pull up the website on the web server.
I thought full NAT was used for that and that full NAT allowed both internal and external computers to reach the server behind the Astaro.
Do I need a DNAT and a FULL NAT rule, and then do I need a packet filter rule made or not?
I have tried this :
my DNAT rule I have tried:
name:websrv-p80 to allow http over port 80
group left blank
position - what ever it becomes
traffic source: any
traffic service: http
traffic destination: external wan address
NAT mode: DNAT
Destination: CPU2
Destination server : left blank
log initial packets checked
Automatic packet filter rule: ?????????????? check or uncheck?
If unchecked - do I need to then create a rule in packet filter for this? Or just check it?
My FULL NAT RULE
name:websrv-p80 to allow http over port 80
group left blank
position - what ever it becomes
traffic source: any
traffic service: http
traffic destination: external wan address
NAT mode: Full NAT
Destination: CPU2
Destination server : left blank
source: external wan address
source service : left blank
log initial packets checked
Automatic packet filter rule: ?????????????? check or uncheck?
If unchecked - do I need to then create a rule in packet filter for this? Or just check it?
I had tried to get screen shots printed how I set up my rules and thought I had good notes, guess not. I was not expecting to have to replace the cpu unit and starting over clean.
I have one ISP connection and no one in the neighborhood has an open WY FI for me to test on. So I must be able to test / view the webpages on the web server from inside of my network with servers inside my network.
Is there one rule that can be set up that allows both external and internal machines to access servers behind the firewall by its outside / external name or I.P.? (not using a DMZ at this time, maybe later on might move server to DMZ)
Chad
This thread was automatically locked due to age.
