IPTABLES How to access to web server on gateway from LAN?

kozaki · 08-25-2005, 03:39 PM

Hi,

I configured Iptables (masquerading) and a Zope server on an old PII with 2 NIC cards running Arch Linux, making it my LAN gateway.
Everything runs fine so far, with SSH access to the server from LAN

Now I just can't figure out how may I get access to the zope site on the server from LAN :
neither public IP nore LAN's server/gateway IP are accessibles from the LAN Sad

IPTABLES config for the LAN (eth1) looks like this :

Code:

iptables -A INPUT -i eth1 -j ACCEPT
iptables -A OUTPUT -o eth1 -j ACCEPT

I need access to the zope portal as I'm its administrator

Do you know how to enable this ?

DaveG · 08-25-2005, 09:07 PM

Since you can access the gateway box over SSH from the local network, the problem is probably with the Zope configuration.

I have NO EXPERIENCE with Zope, but...

Is the service bound to all interfaces or just the WAN port? I had a similar probem with Apache HTTPd - I was the only person in the world that couldn't connect to it - I got eth0 and eth1 IPs mixed up!

kozaki · 08-26-2005, 05:53 AM

As for Zope (I'm talking about this server as well as the previous version that was running on my desktop PC), I tell it to listen on local IP. 'cause if i tell it to listen on my external IP, it fail to answer any request.
Same thing happens if I make it runs on my desktop PC (GW NATing external requests to it).

Now, as you pointed it out, it might be different when Zope runs on a gateway, but this is unclear to me !

PS : note that Peter Harrison says on his excellent iptables page :

Quote:

As a general rule, you won't be able to access the public NAT IP addresses from servers on your home network. Basic NAT testing requires you to ask a friend to try to connect to your home network from the Internet.

DaveG · 08-26-2005, 08:35 AM

Ok, I think I understand....

The Zope service is set up to listen on a local IP address, with NAT doing port-forwarding to allow external access to it.

You won't be able to access the service from the LAN using the public IP address, but you should be able to acces it using the local IP address. Try using the local IP address rather than a domain name when you connect.

If that works then you just need to sort out local DNS. A quick solution is to put an entry in your /etc/hosts to override external DNS. (check /etc/nsswitch.conf also)

kozaki · 08-26-2005, 11:27 AM

Hi DaveG,

Well, actually Zope was configured to listen to 'localhost' IP since that worked (from outside as well as locally) fine when it runned on my Desktop PC.

Now when i installed it on the gateway PC, I first configured it to listen to my ISP's provided IP, but it didn't run this way, so i renned back & told it to listen to 127.0.0.1 as before...

... until I made a better iptables configuration !

I just tried again :
- tell Zope to listen to my ISP's provided IP,
- try to access it from my desktop PC
and that just runs fine

The problem here was an uncomplete iptables configuration, then a wrong configuration of the web server.
Thank you DaveG for helping me to solve my problem