Re: access problem

[Leonardo Carneiro <lscarneiro@veltrac.com.br>]

Hi Paulo,

tks for the tip, i already have a internal DNS, but i don't have a 
external one =/

anyother ideas?


paulobruck1 escreveu:
> Em Seg, 2009-03-16 às 16:41 -0300, Leonardo Carneiro escreveu:
>   
>> Hi everyone.
>>     
>
> Hi Leonardo
>
>   
>> I'm new in the list and hope have a nice time here.
>> First of all, sorry about my poor enlgish, i'm from Brasil.
>>
>>     
> welcome...80)
>
>
>   
>> I've got a standard scenario with a private network (192.168.1.0/24) 
>> beeing natted by a internet server (192.168.1.1) running iptables 1.3.0.
>>
>> In the private network I have a application server (192.168.1.2) running 
>> a service on port 5222. The port is properly forwarded in internet 
>> server, and users across the internet can access the service through the 
>> public IP of the internet server.
>>
>> Users on the private network can access the service through the private 
>> IP of the server, but cannot access using the public ip. Accessing using 
>> the public ip would be very usefull, since lots of users have notebooks 
>> and they access the service inside and outside the private network
>>
>> those are interface infos and the rules forwarding the port to the 
>> application server:
>> eth0: public IP
>> eth1: private network, 192.168.1.1
>>
>>     
> If you like your intenal users use this ip, install a Internal DNS for
> them  and use at your externat ip use a dns too. Example:
>
> Internal DNS
> aplicationsserver  IN A 192.168.1.1
>
> EXternal DNS
> applicationserver IN A XXX.XXX.XXX.XXX
>                  ( your public IP that is redirect to 192.168.1.1)
>
>
> Thats all...
>
>
> best regards	
>
>
>   
>> iptables -A PREROUTING -p tcp -m tcp -d [private_ip] -i eth0 --dport 
>> 5222 -j DNAT --to-destination 192.168.1.2
>> iptables -A FORWARD -p tcp -m tcp -d 192.168.1.2 -i eth0 -o eth1 --dport 
>> 5222 -j ACCEPT
>>
>> I've done some tests, adding some rules like
>>
>> iptables -A PREROUTING -p tcp -m tcp -d [private_ip] -i eth1 --dport 
>> 5222 -j DNAT --to-destination 192.168.1.2
>> iptables -A FORWARD -p tcp -m tcp -d 192.168.1.2 -i eth0 -o eth1 --dport 
>> 5222 -j ACCEPT
>>
>> or just
>>
>> iptables -A PREROUTING -p tcp -m tcp -d [private_ip] -i eth1 --dport 
>> 5222 -j DNAT --to-destination 192.168.1.2
>>
>> but i just cannot connect using the public ip =S
>>
>> sometimes the server answer the request, but using the private ip, no 
>> the public ip requested by the host, and sometimes the server just not 
>> answer the request.
>>
>> any ideas how can i solve this?
>>
>> tks in advance.
>>
>>
>> --
>> To unsubscribe from this list: send the line "unsubscribe netfilter" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>>     
>
>
>