| View previous topic :: View next topic |
| Author |
Message |
eltech
Guru
Joined: 05 Nov 2002
Posts: 582
Location: New York
|
 Posted: Mon Sep 27, 2004 12:20 pm Post subject: Apache Server in DMZ can not be reached. |
 |
|
Hello all.
I was wondering if anyone can lead me into the right direction with this setup.
We had to recently move our server behind a Belkin router; yes i know  ..
So because the router was limited in the amount of ports it could open and this particular server runs so many applications i put it in the router's DMZ.
DNS has propagated and all works fine; mail, the websites, etc.
But for some reason the websites can not be viewed internally. To the world it can be viewed, no problems. Just internally it doesnt work and only the error "Page can not be displayed" is given.
So i have the apache server setup running all the websites under 1 ip (LAN IP) 192.168.2.100:80. When http://192.168.2.100 is typed into an internal browser, the default website pops up.
So, the way i see it, going out to the world for an internal site is ok, but i wouldnt mind just having the domains on their own internal IPs and set a link in like favorites for users. ex: www.domain2.com = 192.168.102, and still have them available to the world.
Hope am being clear.. 
I have messed with the HOSTS file on the client machines, i've tried it all.
So here is my setup and my questions.
Setup:
-Apache running multiple sites
-Bind hosting DNS for the multiple sites.
-Apache is hosting all the sites under a single LAN IP (it is the ip of the server box, 192.168.2.100
-i dont have multiple public static ips to use for the other domains
Questions:
- What would be needed to change to assign the other websites i host different internal LAN IPs? like
www.domain1.com = 192.168.2.100
www.domain2.com = 192.168.2.101
etc......
- Would bind play a role in this change?
- Would setting up a internal zone in bind work? how would i do that? |
|
| Back to top |
|
 |
eltech
Guru
Joined: 05 Nov 2002
Posts: 582
Location: New York
|
| Posted: Mon Sep 27, 2004 8:02 pm Post subject: |
|
|
| bump? |
|
| Back to top |
|
|
kashani
Advocate
Joined: 02 Sep 2002
Posts: 2032
Location: San Francisco
|
|
| Back to top |
|
|
eltech
Guru
Joined: 05 Nov 2002
Posts: 582
Location: New York
|
| Posted: Mon Sep 27, 2004 10:33 pm Post subject: |
|
|
limited info? holy cow! i've seen you help folks who post
"i cant connect with my router, can someone help."
I think i posted adequate enough information for someone who has a clue to help, not everyone can use enough to figure things out, i understand some need more then others.
What else do you need to help with this problem? I dont get it. My post is longer then many who are trying to accomplish something even far more fetched and provide less..
I see your explanation and i see the poster refering to adding the entry to dns
| Quote: | add your public dns name to your /etc/host file.
ie:
10.0.0.5 me.dyndns.org
If you have your own dns on your lan, you can put it in there so you can access your website from any machine from your lan using the dyndns url. That's what I do.
|
I have tried this, but still get the same thing, i dont get it..
Dont take offense to anything i posted, its been a long day in the IT Dept. |
|
| Back to top |
|
|
nightblade
Guru
Joined: 20 Jul 2004
Posts: 368
Location: back from SE Asia
|
| Posted: Mon Sep 27, 2004 11:01 pm Post subject: |
|
|
| kashani wrote: | layer2 end run around is my guess
kashani |
kashani,
in what cases (or for which products/implementations) does such a scenario happen ? In my experience, the dual homed server has always been able to answer with the IP that was contacted, even if that IP was not belonging to the interface directly facing the client... I guess that every half-evolved tcp/ip stack should be able to handle such an event
_________________
In God we trust. All the others must provide a valid X.509 certificate |
|
| Back to top |
|
|
kashani
Advocate
Joined: 02 Sep 2002
Posts: 2032
Location: San Francisco
|
| Posted: Tue Sep 28, 2004 12:22 am Post subject: |
|
|
Hey limited info is limited. You're an IT guy, I expect better from you. 
In any case to really tell what's going on we'd need to know the client IP's. Are they the same range as the server? Maybe a bit about the gateway for the internal clients and how you're routing to the server. Can you ping the server or is it just port 80 you can't reach? Maybe some nice dotted lines network diagrams as well. And the ifconfig and netstat -rn from the server.
In any case you can ignore the nonsense about DNS and look at the explaination about how layer 2 has preference over layer 3. That was the important part of the thread.
kashani
_________________
Will personally fix your server in exchange for motorcycle related shop tools in good shape. |
|
| Back to top |
|
|
kashani
Advocate
Joined: 02 Sep 2002
Posts: 2032
Location: San Francisco
|
| Posted: Tue Sep 28, 2004 12:30 am Post subject: |
|
|
| nightblade wrote: | | kashani wrote: | layer2 end run around is my guess
kashani |
kashani,
in what cases (or for which products/implementations) does such a scenario happen ? In my experience, the dual homed server has always been able to answer with the IP that was contacted, even if that IP was not belonging to the interface directly facing the client... I guess that every half-evolved tcp/ip stack should be able to handle such an event |
It's not a multihome issue, but trying to NAT on your local network and being surprised when it doesn't work locally and works for the rest of the Internet.
kashani
_________________
Will personally fix your server in exchange for motorcycle related shop tools in good shape. |
|
| Back to top |
|
|
nobspangle
Veteran
Joined: 23 Mar 2004
Posts: 1318
Location: Manchester, UK
|
| Posted: Tue Sep 28, 2004 7:39 am Post subject: |
|
|
The solution with the hosts file will work, you have to put the entry in all the hosts files of the client machines it needs to be
| Code: | | internal.ip.of.server public.domain.name.of.server.com |
for your LAN it would be something like
The other solution is to use a dns server. If you are already using bind for your public domain then you need to add a view.
At the top of named.conf | Code: | acl mynet {
192.168.2.0/24;
127.0.0.1;
}; |
Later on in named.conf | Code: | view "internal" {
match-clients { mynet; };
# master for domain1.com
zone "domain1.com" IN {
type master;
file "pri/domain1.com.local";
allow-query {mynet;};
allow-transfer {mynet;};
};
#place any other local zone files here including
#reverse mapping for your local subnet
};
view "external" {
match-clients { any; };
#place all your other zone files including public ones here
}; |
|
|
| Back to top |
|
|
eltech
Guru
Joined: 05 Nov 2002
Posts: 582
Location: New York
|
| Posted: Tue Sep 28, 2004 10:45 am Post subject: |
|
|
| nobspangle wrote: | The solution with the hosts file will work, you have to put the entry in all the hosts files of the client machines it needs to be
| Code: | | internal.ip.of.server public.domain.name.of.server.com |
for your LAN it would be something like
The other solution is to use a dns server. If you are already using bind for your public domain then you need to add a view.
At the top of named.conf | Code: | acl mynet {
192.168.2.0/24;
127.0.0.1;
}; |
Later on in named.conf | Code: | view "internal" {
match-clients { mynet; };
# master for domain1.com
zone "domain1.com" IN {
type master;
file "pri/domain1.com.local";
allow-query {mynet;};
allow-transfer {mynet;};
};
#place any other local zone files here including
#reverse mapping for your local subnet
};
view "external" {
match-clients { any; };
#place all your other zone files including public ones here
}; |
|
Hmm, see i am more enthused to try the bind fix as i have already tried the HOSTS file fix and there was no luck.
What would i suppliment for the 'mynet' entry
and would i also use the 'acl' syntax that you used? |
|
| Back to top |
|
|
eltech
Guru
Joined: 05 Nov 2002
Posts: 582
Location: New York
|
| Posted: Tue Sep 28, 2004 10:51 am Post subject: |
|
|
Secondly, what would the whole entry for the named.conf look like with both entries in order, am asking about the ones you noted.
Should i be setting up a zone file for the local servers?
Should i changing the internal ip addresses for every site i host in apache?
Where can i get more info on this kind of set up.. |
|
| Back to top |
|
|
eltech
Guru
Joined: 05 Nov 2002
Posts: 582
Location: New York
|
| Posted: Fri Oct 01, 2004 9:00 pm Post subject: |
|
|
| bump |
|
| Back to top |
|
|
nobspangle
Veteran
Joined: 23 Mar 2004
Posts: 1318
Location: Manchester, UK
|
| Posted: Fri Oct 01, 2004 11:11 pm Post subject: |
|
|
google link
The top one should tell you everything you need to know |
|
| Back to top |
|
|
eltech
Guru
Joined: 05 Nov 2002
Posts: 582
Location: New York
|
| Posted: Sun Oct 31, 2004 4:12 pm Post subject: |
|
|
| The router was the culprit. After exchanging the router with a Linksys BEFSRv11, all was well |
|
| Back to top |
|
|
|
Networking & Security
