* local forwarding(?)
@ 2003-01-17 11:15 cc
2003-01-17 11:38 ` Raymond Leach
2003-01-17 11:50 ` Narendra Prabhu. B
0 siblings, 2 replies; 3+ messages in thread
From: cc @ 2003-01-17 11:15 UTC (permalink / raw)
To: netfilter
Hi,
I finally got the bridge working and so far,
things look ok.
From the outside, I can goto the website. That's
no problem. The problem is for local machines
going to http://www.mydomain.com/, the firewall
doesn't seem to be redirecting it properly.
LAN users have to use http://192.168.11.10/ to
access the website instead of the www.mydomain.com.
I understand that the actual ip address skips
the firewall and goes directly to the machine.
From my boss' point of view(totally ignorant
that 192.168.11.10 = www.mydomain.com), he
doesn't like that. So I'm hoping that he
can access (locally) www.mydomain.com.
So far my firewall script (the lines pertaining
to the www port) is as follows:
$IPTABLES -t nat -A PREROUTING -p tcp -i eth0 x.x.x.x \
--dport 80 -j DNAT --to 192.168.10.11
$IPTABLES -A FORWARD -p tcp -i eth0 -d 192.168.10.11 \
--dport 80 -j ACCEPT
$IPTABLES -A FORWARD -p tcp -i eth0 --dport 80 -j DROP
(I'm not entirely sure about that last item. It looks
strangely invalid...but I could be wrong. I don't
even think I should have that there.. am I right?)
If all my LAN ips are of the 192.168.10.0 host,
and the web server is 192.168.10.11, how do I
get the LAN clients to go to www.mydomain.com and
have the firewall redirect the packets to 192.168.10.11?
As you probably can figure out, I'm a little confused.
Any help appreciated
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: local forwarding(?)
2003-01-17 11:15 local forwarding(?) cc
@ 2003-01-17 11:38 ` Raymond Leach
2003-01-17 11:50 ` Narendra Prabhu. B
1 sibling, 0 replies; 3+ messages in thread
From: Raymond Leach @ 2003-01-17 11:38 UTC (permalink / raw)
To: cc; +Cc: Netfilter Mailing List
[-- Attachment #1: Type: text/plain, Size: 2952 bytes --]
On Fri, 2003-01-17 at 13:15, cc wrote:
> Hi,
>
> I finally got the bridge working and so far,
> things look ok.
>
> >From the outside, I can goto the website. That's
> no problem. The problem is for local machines
> going to http://www.mydomain.com/, the firewall
> doesn't seem to be redirecting it properly.
> LAN users have to use http://192.168.11.10/ to
> access the website instead of the www.mydomain.com.
>
> I understand that the actual ip address skips
> the firewall and goes directly to the machine.
> >From my boss' point of view(totally ignorant
> that 192.168.11.10 = www.mydomain.com), he
> doesn't like that. So I'm hoping that he
> can access (locally) www.mydomain.com.
>
> So far my firewall script (the lines pertaining
> to the www port) is as follows:
>
> $IPTABLES -t nat -A PREROUTING -p tcp -i eth0 x.x.x.x \
> --dport 80 -j DNAT --to 192.168.10.11
> $IPTABLES -A FORWARD -p tcp -i eth0 -d 192.168.10.11 \
> --dport 80 -j ACCEPT
> $IPTABLES -A FORWARD -p tcp -i eth0 --dport 80 -j DROP
>
> (I'm not entirely sure about that last item. It looks
> strangely invalid...but I could be wrong. I don't
> even think I should have that there.. am I right?)
Depends on the default POLICY for your FORWARD chain. If the default
policy is to drop, then you don't need it.
>
> If all my LAN ips are of the 192.168.10.0 host,
> and the web server is 192.168.10.11, how do I
> get the LAN clients to go to www.mydomain.com and
> have the firewall redirect the packets to 192.168.10.11?
>
Is the firewall the gateway to the internet for your users?
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -d
www.mydomain.com -j REDIRECT --to-destination 192.168.10.11:80
That should work (eth0 is your internal interface, right?) ...
Of course you also need the forwarding rules:
iptables -A FORWARD -p tcp --dport 80 -d 192.168.1.11 -j ACCEPT
iptables -A FORWARD -p tcp --sport 80 -s 192.168.1.11 -j ACCEPT
These are very wide open rules. You might want to add the -i and maybe
state checking...
> As you probably can figure out, I'm a little confused.
>
> Any help appreciated
>
--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
( Raymond Leach )
) Knowledge Factory (
( )
) Tel: +27 11 445 8100 (
( Fax: +27 11 445 8101 )
) (
( http://www.knowledgefactory.co.za/ )
) http://www.saptg.co.za/ (
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
o o
o o
.--. .--.
| o_o| |o_o |
| \_:| |:_/ |
/ / \\ // \ \
( | |) (| | )
/`\_ _/'\ /'\_ _/`\
\___)=(___/ \___)=(___/
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: local forwarding(?)
2003-01-17 11:15 local forwarding(?) cc
2003-01-17 11:38 ` Raymond Leach
@ 2003-01-17 11:50 ` Narendra Prabhu. B
1 sibling, 0 replies; 3+ messages in thread
From: Narendra Prabhu. B @ 2003-01-17 11:50 UTC (permalink / raw)
To: cc; +Cc: netfilter@lists.netfilter.org
On Fri, 17 Jan 2003, cc wrote:
> Hi,
>
> I finally got the bridge working and so far,
> things look ok.
Congrates ..
>
> From the outside, I can goto the website. That's
> no problem. The problem is for local machines
> going to http://www.mydomain.com/, the firewall
> doesn't seem to be redirecting it properly.
> LAN users have to use http://192.168.11.10/ to
> access the website instead of the www.mydomain.com.
>
> I understand that the actual ip address skips
> the firewall and goes directly to the machine.
> From my boss' point of view(totally ignorant
> that 192.168.11.10 = www.mydomain.com), he
> doesn't like that. So I'm hoping that he
> can access (locally) www.mydomain.com.
>
> So far my firewall script (the lines pertaining
> to the www port) is as follows:
>
> $IPTABLES -t nat -A PREROUTING -p tcp -i eth0 x.x.x.x \
> --dport 80 -j DNAT --to 192.168.10.11
There is no -d or -s option in the above command ....
Well, I guess that would be your public ip and the option would be -d in
that case.
Two things possible :-
1> What IP address does the your dns resolve for www.mydomain.com
a)x.x.x.x
b)192.168.10.11
try: $dig www.mydomain.com
2> Check wheather eth0 is really your internal interface !! As you
have set up a bridge you can as well say the <bridge interface>
<br0> .. But if you are really paranoid about the security then
try eth1 also.
try: put separate rules for eth0 and eth1 and check which counter
is incretmented... $iptables -nvL ....
> $IPTABLES -A FORWARD -p tcp -i eth0 -d 192.168.10.11 \
> --dport 80 -j ACCEPT
Again, check the counters.
> $IPTABLES -A FORWARD -p tcp -i eth0 --dport 80 -j DROP
>
> (I'm not entirely sure about that last item. It looks
> strangely invalid...but I could be wrong. I don't
> even think I should have that there.. am I right?)
In my perseption, you dont want any other web site to be visited with this
rule.
>
> If all my LAN ips are of the 192.168.10.0 host,
> and the web server is 192.168.10.11, how do I
> get the LAN clients to go to www.mydomain.com and
> have the firewall redirect the packets to 192.168.10.11?
>
> As you probably can figure out, I'm a little confused.
>
> Any help appreciated
Let us know if it helps you.
Bye,
Narendra.
In the middle of difficulty..... lies Opportunity. (Albert Einstein)
--------------------------------------------------------------------
Narendra Prabhu. B Free Software at its product-ive best.
DeepRoot Linux http://www.deeproot.co.in
---- Server Appliances ----
---- Linux Support and Services ----
-------------------------------------------------------------------
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2003-01-17 11:50 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-01-17 11:15 local forwarding(?) cc
2003-01-17 11:38 ` Raymond Leach
2003-01-17 11:50 ` Narendra Prabhu. B
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.