<p><br /><br /> Thanks Rick, great help. I think the reverse proxy sounds like a great idea and looks simple to implement. I need the webserver to be on the same subnet as the lan.</p><p>Did you attempt the snat option or did you just go straight for one of the 3 below? I'm puzzled as to why it won't work for me.<br /></p><p>cheers</p><p>Rich<br /><br /><strong>On Wed Oct 3 21:10 , Rick Marshall sent:<br /><br /></strong><blockquote style="border-left: 2px solid rgb(245, 245, 245); margin-left: 5px; margin-right: 0px; padding-left: 5px; padding-right: 0px;">Hi Rich<br />
<br />
Minor note - your LAN is 192.168.0.0/24 - but this doesn't affect the <br />
rest of your problem.<br />
<br />
I have this scenario working well, but I have done it using one of three <br />
tricks.<br />
<br />
1. Extra address. Put the web server on a different subnet - say <br />
192.168.1.... You can overload the IP addresses on the firewall to <br />
access the web server through the same interface card.<br />
<br />
2. Run a copy of apache on the firewall and use ReverseProxy to access <br />
the internal web server. If you do this you need to run your web site <br />
stats program on the firewall.<br />
<br />
3. More complex setup for a busy office puts the web server in a DMZ <br />
with 2 interface cards, run a second name server to give internal <br />
addresses to internal machines which are on the internal lan and run a <br />
third interface card on the firewall to keep the traffic separated.<br />
<br />
Regards<br />
Rick<br />
<br />
<a href="javascript:top.opencompose('rich@thevillas.eclipse.co.uk','','','')">rich@thevillas.eclipse.co.uk</a> wrote:<br />
><br />
> Hi,<br />
> I have a LAN that accesses the internet through a single firewall <br />
> machine which has 2 network cards.<br />
> I use SNAT to give all of my LAN machines the static external IP of <br />
> this firewall machine when they venture out.<br />
> For internet traffic coming in to the firewall i use DNAT to forward <br />
> it to my webserver on the LAN.<br />
><br />
> So, assuming that:<br />
><br />
> 1) my LAN has private addresses:<br />
> 192.168.0.0/16<br />
> 2) my firewall has the external internet-visible address:<br />
> x.x.x.x<br />
> 3) my firewall has the internal LAN-visible address:<br />
> 192.168.0.18<br />
> 4) my webserver has my LAN private address:<br />
> 192.168.0.11<br />
><br />
> I have an iptables DNAT (destination nat) rule to redirect traffic thus:<br />
> tcp x.x.x.x:80 -> 192.168.0.11:80<br />
><br />
> However whilst this is lovely for external clients, it doesn't work for<br />
> my LAN because:<br />
> a) LAN client 192.168.0.Y contacts x.x.x.x via the default<br />
> route (the firewall).<br />
> b) firewall DNATs the connection to LAN webserver destination<br />
> 192.168.1.110 but leaves the source address unchanged as 192.168.0.Y<br />
> c) LAN webserver 192.168.0.11 replies direct to LAN client<br />
> 192.168.0.Y because it is on the same network, but LAN client wasn't<br />
> talking to 192.168.0.11 when it started the connection and therefore<br />
> ignores these packets.<br />
><br />
> I think I should be able to simply rewrite the source address in (b) <br />
> to the internal<br />
> address of my firewall so that all replies from the webserver come<br />
> back via the firewall and can be correctly de-mangled. In other words<br />
> all communiction between LAN clients and my webserver will be<br />
> dog-legged via the firewall.<br />
><br />
> BUT, this doesn't work with my current firehol config.<br />
> Please please could someone point out where my config is wrong?<br />
> I have spent hours and hours one this but can't figure it out<br />
><br />
> Thanks in advance<br />
> #####################CONFIG BELOW######################<br />
><br />
><br />
> # The definition of our HOME LAN.<br />
> HOME_MYIP="192.168.0.18" # The IP on our HOME LAN<br />
> HOME_MYIF="eth1" # The HOME LAN interface<br />
> HOME_BCAST="192.168.1.255" # The HOME LAN broadcast<br />
> HOME_LAN="192.168.1.0/255.255.255.0" # The HOME LAN<br />
> HOME_SERVICES="all"<br />
><br />
> HOME_DHCP=0 # Set to 0 to disable<br />
><br />
><br />
> # --- PUBLIC ---<br />
><br />
> # The definition of our PUBLIC interface.<br />
> PUBLIC_MYIP="x.x.x.x" # Leave empty for dynamic IP<br />
> PUBLIC_MYIF="eth0" # The public interface<br />
> PUBLIC_SERVICES="ssh http https"<br />
><br />
> # Is the PPP interface a DIAL-ON-DEMAND?<br />
> DIAL_ON_DEMAND=0 # Set to 0 to disable<br />
><br />
><br />
> # --- TRUSTED ---<br />
><br />
> # Hosts in the internet I trust for accessing private services<br />
> # Empty these to disable.<br />
> TRUSTED_IPS=""<br />
> TRUSTED_SERVICES=""<br />
><br />
><br />
><br />
> # --- BLACKLIST ---<br />
><br />
> # A space-separated list of IPs to be blocked.<br />
> blacklist=""<br />
><br />
><br />
> # <br />
> ----------------------------------------------------------------------------<br />
> # HELPERS<br />
> # <br />
> ----------------------------------------------------------------------------<br />
><br />
> # Block all traffic from/to certain IPs<br />
> if [ ! -z "${blacklist}" ]<br />
> then<br />
> blacklist full "${blacklist}"<br />
> fi<br />
><br />
><br />
><br />
> # <br />
> ----------------------------------------------------------------------------<br />
> # NETWORK ADDRESS TRANSLATION<br />
> # <br />
> ----------------------------------------------------------------------------<br />
> # Change the source/destination of packets...<br />
><br />
> # Should we do SNAT or MASQUERADE?<br />
> # If there is a PUBLIC_MYIP defined, we should do SNAT, otherwise MASQ.<br />
> #<br />
> if [ ! -z "${PUBLIC_MYIP}" ]<br />
> then<br />
><br />
> snat to "${PUBLIC_MYIP}" \<br />
> outface "${PUBLIC_MYIF}" \<br />
> src "${HOME_LAN}" dst not "${UNROUTABLE_IPS}"<br />
><br />
> snat to "${HOME_MYIP}" \<br />
> outface "${HOME_MYIF}" \<br />
> src "${HOME_LAN}" dst "${PUBLIC_MYIP}"<br />
><br />
> else<br />
> masquerade "${PUBLIC_MYIF}"<br />
> fi<br />
><br />
><br />
> # To have some public service hit an internal machine, do this:<br />
><br />
> dnat to 192.168.0.11:80 \<br />
> inface "${PUBLIC_MYIF}" \<br />
> src not "${HOME_LAN} ${UNROUTABLE_IPS}" \<br />
> proto tcp dport 80<br />
> <br />
><br />
><br />
> # <br />
> ----------------------------------------------------------------------------<br />
> # PROTECT SELF<br />
> # <br />
> ----------------------------------------------------------------------------<br />
> # Protect the firewall host...<br />
><br />
> # --- HOME ---<br />
><br />
> # Protect us from the HOME LAN<br />
> interface "${HOME_MYIF}" home src "${HOME_LAN}" dst "${HOME_MYIP} <br />
> ${HOME_BCAST}"<br />
> policy reject<br />
> <br />
> server "${HOME_SERVICES}" accept<br />
> <br />
> client all accept<br />
><br />
> <br />
> # DHCP needs 0.0.0.0/255.255.255.255 access.<br />
> if [ ${HOME_DHCP} -eq 1 ]<br />
> then<br />
> interface "${HOME_MYIF}" dhcp<br />
> server dhcp accept<br />
> fi<br />
><br />
><br />
> # --- PUBLIC ---<br />
><br />
> # Protect us from the PUBLIC<br />
> interface "${PUBLIC_MYIF}" internet \<br />
> src not "${UNROUTABLE_IPS}" \<br />
> `test ! -z "${PUBLIC_MYIP}" && echo "dst '${PUBLIC_MYIP}'"`<br />
> <br />
> protection strong<br />
> policy drop<br />
> <br />
> # Are there any trusted PCs/services?<br />
> if [ ! -z "${TRUSTED_PCS}" -a ! -z "${TRUSTED_SERVICES}" ]<br />
> then<br />
> server "${TRUSTED_SERVICES}" accept src "${TRUSTED_PCS}"<br />
> fi<br />
> <br />
> server "${PUBLIC_SERVICES}" accept<br />
> <br />
> client all accept<br />
><br />
> # DIAL-ON-DEMAND needs this in case there is a PUBLIC_MYIP defined.<br />
> if [ ${DIAL_ON_DEMAND} -eq 1 ]<br />
> then<br />
> interface "${PUBLIC_MYIF}" dialup<br />
> client all accept<br />
> fi<br />
><br />
><br />
> # <br />
> ----------------------------------------------------------------------------<br />
> # PROTECT ROUTING<br />
> # <br />
> ----------------------------------------------------------------------------<br />
> # Protect the LAN...<br />
><br />
> # Route traffic for the clients on the LAN<br />
> router internet2lan inface "${PUBLIC_MYIF}" outface "${HOME_MYIF}" \<br />
> src not "${UNROUTABLE_IPS}" dst "${HOME_LAN}"<br />
> <br />
> # route all client traffic<br />
> client all accept<br />
> <br />
> # For the dnat example above, this is needed:<br />
> server http accept dst 192.168.0.11<br />
><br />
> <br />
> ------------------------------------------------------------------------<br />
><br />
> -------------------------------------------------------------------------<br />
> This SF.net email is sponsored by: Splunk Inc.<br />
> Still grepping through log files to find problems? Stop.<br />
> Now Search log events and configuration files using AJAX and a browser.<br />
> Download your FREE copy of Splunk now >> <a target="_blank" href="parse.pl?redirect=http%3A%2F%2Fget.splunk.com%2F">http://get.splunk.com/</a><br />
> ------------------------------------------------------------------------<br />
><br />
> _______________________________________________<br />
> Firehol-support mailing list<br />
> <a href="javascript:top.opencompose('Firehol-support@lists.sourceforge.net','','','')">Firehol-support@lists.sourceforge.net</a><br />
> <a target="_blank" href="parse.pl?redirect=https%3A%2F%2Flists.sourceforge.net%2Flists%2Flistinfo%2Ffirehol-support">https://lists.sourceforge.net/lists/listinfo/firehol-support</a><br />
> <br />
</blockquote>
</p><BR>