<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
correct thread.<br>
<br>
this is where the reverse proxy function of apache comes in handy - it
will redirect the traffic instead of dnat - you talk to the server on
the firewall that redirects traffic to the server behind the firewall.
works no matter where the traffic comes from.<br>
<br>
seems awkward, but afik it is the best way to do it<br>
<br>
Regards<br>
Rick<br>
<br>
Avin Sigurani wrote:
<blockquote cite="mid:1199078354.12823.26.camel@localhost" type="cite">
<pre wrap="">Thank you, that is helpful. I was not aware of that.
When you speak of the solution you posted, are you talking about the
thread at
<a class="moz-txt-link-freetext" href="http://sourceforge.net/mailarchive/forum.php?thread_name=63jqje%">http://sourceforge.net/mailarchive/forum.php?thread_name=63jqje%</a>
242s1f63%40venus.eclipse.kcom.com&forum_name=firehol-support ?
If so, I think there may be a problem for me in the line:
dst "${PUBLIC_MYIP}" proto tcp dport 80
in the dnat rule. I don't have a static IP, so includeing
"${PUBLIC_MYIP}" in the rule means it would have to be changed every
time my ip changed, right? But how else do I differentiate traffic
going to external sites and traffic going to the web server on my
network?
Also, I went to
<a class="moz-txt-link-freetext" href="http://sourceforge.net/mailarchive/forum.php?forum_name=firehol-support">http://sourceforge.net/mailarchive/forum.php?forum_name=firehol-support</a> , but every search I tried produced 0 results, even for subjects I new existed in a particular thread. Where do I go to search the mailing list archives?
On Mon, 2007-12-31 at 14:49 +1100, Rick Marshall wrote:
</pre>
<blockquote type="cite">
<pre wrap="">hi
The best way to solve this is to put the web server and any other
externally accessed servers on their own subnet.
This is because you cannot use snat/dnat to the same subnet as the
sending machine - not entirely sure why - it has to do with routing,
</pre>
</blockquote>
<pre wrap=""><!---->but
</pre>
<blockquote type="cite">
<pre wrap="">it doesn't work. The good news is that with modern iptables you can
overload an interface with 2 ip addresses (so you don't need extra
ethernet cards). I posted a solution for this earlier - it should
</pre>
</blockquote>
<pre wrap=""><!---->show
</pre>
<blockquote type="cite">
<pre wrap="">up in the searches.
Regards
Rick
Avin Sigurani wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I have a web server on an internal machine and forward all web
</pre>
</blockquote>
</blockquote>
<pre wrap=""><!---->requests
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">to this machine. This works fine for all machines external to the
</pre>
</blockquote>
</blockquote>
<pre wrap=""><!---->lan,
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">but machines on the lan cannot access the web server. I saw this
solution:
snat to "${HOME_MYIP}" \
outface "${HOME_MYIF}" \
src "${HOME_LAN}" dst "${WEBSERVER}"
dnat to ${WEBSERVER}:80 \
inface "${HOME_MYIF}" \
src "${HOME_LAN}" \
dst "${PUBLIC_MYIP}" proto tcp dport 80
router lan2lan inface "${HOME_MYIF}" outface "${HOME_MYIF}" \
src "${HOME_LAN}" dst "${HOME_LAN}"
server http accept
server https accept
However, I use dyndns and have a dynamic IP address. How could I do
this in such a case?
</pre>
</blockquote>
</blockquote>
<pre wrap=""><!---->-------------------------------------------------------------------------
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
<a class="moz-txt-link-freetext" href="http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/">http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/</a>
_______________________________________________
Firehol-support mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Firehol-support@lists.sourceforge.net">Firehol-support@lists.sourceforge.net</a>
<a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/firehol-support">https://lists.sourceforge.net/lists/listinfo/firehol-support</a>
</pre>
</blockquote>
</blockquote>
<pre wrap=""><!---->
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
<a class="moz-txt-link-freetext" href="http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/">http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/</a>
_______________________________________________
Firehol-support mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Firehol-support@lists.sourceforge.net">Firehol-support@lists.sourceforge.net</a>
<a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/firehol-support">https://lists.sourceforge.net/lists/listinfo/firehol-support</a>
</pre>
</blockquote>
</body>
</html>