accessing external IP from internal network

vayn2004

OK, I have an iptables question.

I am running a webserver on my home network. I have it port forwarded to the internet on my firewall machine using iptables.

Now I am trying to run some blogging software on it, and use it on the machine that is hosting it on as well as from other locations via the internet.

My problem is that when I use it on the local machine, I get an error because it it trying to access itself from the my external IP.

My question is does anyone know if you can set iptables so that you can access your external IP from your internal network, kind of like a looopback, and if so, what would the rule look like?

Ateo · Posted: Mon Jan 10, 2005 6:57 am Post subject:

This can't be done. You'll need to add your webserver to your /etc/hosts file. The reason: a routers job (which is what ipchains does) is to route from one network to another network. A router cannot "route" within it's own network. In a nutshell, a network interface cannot send a packet out the same way it came in....

There's an RFC on that unless it's been changed in recent times. Check an RFC database.

robdd · Posted: Mon Jan 10, 2005 11:10 am Post subject:

Sorry if this is too obvious, but why don't you just set up the web server to serve on two ports, say, 80 and 8080. Forward port 80 through your firewall (I guess you've already done that). Then if you want to connect from the local machine put in the same URL, but add the port number on the end:

http://localwebserver/somedisplay.html:8080

I know this doesn't answer the iptables question, and I always find I have trouble configuring apache anyway - but at least it gets you going.

Regards,
_________________
Rob Diamond
Gentoo Hack, hack, hacker
Sydney, Australia

adaptr · Posted: Mon Jan 10, 2005 11:15 am Post subject:

I can see why you have trouble configuring apache ;-)

You must add the port after the hostname, and before any location information, like so:

http://myserver:8080/somedocument.html

Nothing else will work...
_________________
>>> emerge (3 of 7) mcse/70-293 to /
Essential tools: gentoolkit eix profuse screen

adaptr

nielchiano · Veteran Joined: 11 Nov 2003 Posts: 1287 Location: 50N 3E

vayn2004 · Posted: Tue Jan 11, 2005 3:51 am Post subject:

Actually none of what anyone has suggested will work for my configureation.

All of the blogging package scripts know itself by the IP which is my external IP since I don't have a domain name. It has to use that to work when I access it from the external world. That means there is no DNS...I'm not using any name.

My wording may be a bit technically erroronious but what I was asking for was accurate, which is if there is any way to access the site from the external world and my network via the same IP... my external IP. That s the only way it will work.

nielchiano · Veteran Joined: 11 Nov 2003 Posts: 1287 Location: 50N 3E

vayn2004 · Posted: Fri Jan 14, 2005 10:35 pm Post subject:

So far I can't get this to work. I'm not sure I know how to adapt this to my firewall..

Here is the relavant section if my firewall srcipt:

forbjok · Posted: Sat Jan 15, 2005 12:47 am Post subject:

Been there

Check this out:
https://forums.gentoo.org/viewtopic.php?t=245680

The solution I posted there is not ideal, but it works.
A better solution may be to simply SNAT all packets destined for the external IP, coming from an internal interface.

Try this: (not tested personally.. almost 2AM here... so syntax may be wrong, but the basic idea should still be correct.)