LinuxQuestions.org
LinuxAnswers - the LQ Linux tutorial section.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 11-07-2006, 01:52 PM   #1
edywas
LQ Newbie
 
Registered: Nov 2006
Posts: 7

Rep: Reputation: 0
internal LAN IPs to get accessed from Internet ( not through port forwarding )


Hello gents,

here is the problem i am facing, any help will be much appreciated.

I have a Linux PC configured as gateway to my private network.
Also the gateway holds the DNS of wwwDOTmy-domainDOTcom.
Gateway has 2 NICs
ETH0 - going outside
ETH1 - inside the network

Inside the network i have 20 PCs most of them are workstations with Windows but i also have 4 to 8 Linux Servers.

I am interested in exposing the Linux Servers ( for the sake of the problem definition let's say all 8 of them ) i have within the network, on Internet for direct access through the Gateway of course.

I have 8 external IPs ( the ISP provide me with 8 IPs as subclasses to the ETH0 IP ).

1-st question is ( from back to end ):
=================
What do i need to do in order to expose each of the Servers to get accesss from Internet as "subdomains" or more clear :
If my DNS is wwwDOTmy-domainDOTcom
i would like to get the 8 intranet Servers accessed as:
Server1DOTmy-domainDOTcom
Server2DOTmy-domainDOTcom
...
Server8DOTmy-domainDOTcom

2-nd question is :
================
I did set up 1-st the IPs the ISP gave to me ( as subclasses to the IP o f my domain ) to each Server , but i can not get them pinged from outside.
So i wonder what else i need to do beside setting up the external IPs as i recived from the ISP through ETH1, in order to get the Servers 1-st of all pinged from Internet, and only afterwards the 1-st question in which i will substitute the IPs with "subdomain" names like Server1DOTmy-domainDOTcom for Server1 and so on.

Thank you.
I will really appreciate.

BR.
 
Old 11-08-2006, 07:41 AM   #2
zhjim
Senior Member
 
Registered: Oct 2004
Distribution: Debian Squeeze x86_64
Posts: 1,453
Blog Entries: 11

Rep: Reputation: 182Reputation: 182
Answer to 1:

You would need an DNS-Server. Either it being external or internal. External would be easier cause your already have a dns entry that serves for www.mydomain.com.
Just see if you can get the person providing this dns entry to setup some subdomains refering to the 8 ip's your IPS gave you.

Internal would be a bit more work involved. You have to setup an own dns-server (bind f.e.) and have the dns entry for www.mydomain.de to reflect your internal dns-server. Check out the bind manual on the website of bind how to do this.

Answer to 2:

As every outward connection to any of these 8 ip's comes through your gateway you have to distribute from there. Easy way is to use iptables and nat to forward every incoming traffic for one ip to the server you want it to. The internal ip's need not and should not have the same ip as the outward ip's.
Check out the man page of iptables.

There are definetly other solution for this, but I don't know them.

And a final point of advice. Please don't have the workstation and the servers in one network range for security reasons. If you have an extra NIC put it into your gateway and connect only the servers to that nic.

You have a long way to go. Hope it helps.

Regards Zhjim
 
Old 11-10-2006, 07:56 AM   #3
edywas
LQ Newbie
 
Registered: Nov 2006
Posts: 7

Original Poster
Rep: Reputation: 0
Hi zhjim,
and thank you for your reply.

I did manage to do all i mentioned here.
Yes indeed , i manage the DNS so that i was in complete control of what i was asking and therefore found my way in doing so.

Yes,
i would like to follow your advice ( was my thought in the 1-st place as well ) in all you said about keeping Servers and workstations inside a LAN and expose the Servers outside, on different NICs.
I am not sure yet how to do it and if it worthes for me to add a 3-rd NIC.
You see ? the Servers are not for permanent exposure , but only for when i need to.

More than a secure issue here i have a network infrastructure question:
For when i want the LAN Servers to be seen from Internet and for when i want them to be used only on the intranet LAN , i would like to be able to make a single switch between the differnet Internet TCP/IP settings of the Networks on the Servers.

Is this possible ?
My problem is that the internal NIC needs to stay on the sub-class of IPs that will allow me to make the Servers online to Internet when i want to , i wonder if i use Ips within the same sub-class of IPs which are not published will stay offline for Internet ... i need to check this... if you think better networking infrastructure pls let me know.

all the best.
 
Old 11-10-2006, 09:48 AM   #4
zhjim
Senior Member
 
Registered: Oct 2004
Distribution: Debian Squeeze x86_64
Posts: 1,453
Blog Entries: 11

Rep: Reputation: 182Reputation: 182
The normal setup for lan with exposed servers. Straigth from the books.

Gateway with three nics.
First nic connected to Internet (WAN)
Second nic connected to Workstationswitch (LAN)
Third nic connected to Demilitarized Zone holding the servers (DMZ)

There are some more complex setups, but thats the easiest one and I think the best fitting for your situtation.

Quote:
For when i want the LAN Servers to be seen from Internet and for when i want them to be used only on the intranet LAN , i would like to be able to make a single switch between the differnet Internet TCP/IP settings of the Networks on the Servers.

Is it possible?
Definetly possible. And some ways to do this.

You could change the ip addresses of the server so that they match the ip a query from outward dns would get.
Means you just setup the DNS zone for the servers, setup the gatway to do the natting, but don't give the server the ip that is shown in the zone. And then when you need incoming connect form INET you just change the ips of the server.

Or a maybe better solution is doing this through DNS.
Ok. you can tell a DNS server to return diffrent ips depending on where the query comes from. So when you want the INET to acces your servers you would change your dns settings and the INET can reach your servers. This way you can also block the acces from local net to the servers during this time.

Maybe we can find a even better solution when you describe your LAN setup you actually are using know. With switches and everything.

I definetly can find some more usable solution, but am a bit exhausted right know. Friday u know.

Zhjim
 
Old 10-26-2007, 03:30 PM   #5
Pingala
LQ Newbie
 
Registered: Oct 2007
Posts: 1

Rep: Reputation: 0
Configurating LinkSys Wireless Router for LAN IPs to get Accessed from Internet

I am having a similar problem. I have a bunch of workstations (including server) on my internal LAN (192.168.1.0 segment). I have LinkSys Wireless Router acting as a Gateway to ISP internet.
I would like to configure ONE workstation (say 192.168.1.10) to be accesssed from the Internet. How do I configure LinkSys router?

Thanks in advance,

Pingala
 
  


Reply

Tags
bind, external, ip, linux, named, networking, subdomain


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
External port forwarding to an internal host antken Linux - Networking 3 12-17-2006 09:43 AM
Smoothwall selective forwarding from the same port to different internal computers jimdaworm Linux - Networking 4 03-16-2005 01:44 PM
Port Forwarding not working for Internal requests angelgw Linux - Networking 2 06-29-2003 12:42 AM
IPTABLES port forwarding to internal network ivanros Linux - Networking 2 12-28-2002 10:19 PM
Port forwarding to internal machine zamzara Linux - Networking 8 12-01-2002 12:21 AM


All times are GMT -5. The time now is 10:47 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration