LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 05-04-2004, 05:25 PM   #1
mpgram
Member
 
Registered: Sep 2003
Location: Dallas TX
Distribution: Red Hat
Posts: 59

Rep: Reputation: 15
IPTABLES and local Webserver


I have tried a few solutions on the boards, haven't gotten anywhere with them, so here we go.

I can access my webserver from any external computer. I cannot access it local. If I type in the domain name I get a "The page cannot be displayed" message. I am almost 100% it has to do with my firewall script. Now, before I go insane, here is the script.

# Allow all internal systems out
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

# Foward port 80 to webserver
iptables -t nat -A PREROUTING -p tcp --dport 110 -i ppp0 -j DNAT --to 192.168.2.40:80


I have other ports open, but none are important.

Any ideas?
 
Old 05-05-2004, 10:42 AM   #2
TheIrish
Member
 
Registered: Oct 2003
Location: ITALY
Distribution: Debian, Ubuntu, Fedora
Posts: 137

Rep: Reputation: 15
Maybe i'm missing something...
A little reminder:
Code:
# Allow all internal systems out
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
This is not exactly what it does. It does Masquerade. Allowing or denying is defined elsewhere. Take a look at that.
Code:
# Foward port 80 to webserver
iptables -t nat -A PREROUTING -p tcp --dport 110 -i ppp0 -j DNAT --to 192.168.2.40:80
In this code i presume you want to receive web data addressed to port 110 and forward it to port 80... what if someone tries to make a pop request? I really don't know, but I guess your webserver might not like it. Why don't you just forward 80 to 80 ?

Other than these few ideas, a reason for your problem might be the fact that:
assuming your external net address is 202.202.x.x, if the DNS is external, it resolves the name mydomain.com as 202.202.x.x .
Now, this could be a problem if, performing a web request from the lan, your box doesn't resolve 202.202.x.x as 192.168.2.40... am i wrong? (could be...)
Normally, this is done automatically, so... assuming it works correctly, refering at your iptables rule:
Code:
# Foward port 80 to webserver
iptables -t nat -A PREROUTING -p tcp --dport 110 -i ppp0 -j DNAT --to 192.168.2.40:80
You're DNATing only data coming from interface ppp0 but your request actually comes from the inside...
Try to modify this statement and let us know if it works!
 
Old 05-05-2004, 11:51 AM   #3
mpgram
Member
 
Registered: Sep 2003
Location: Dallas TX
Distribution: Red Hat
Posts: 59

Original Poster
Rep: Reputation: 15
Okay...

I have tried to modify that line, but let me explain all I have done (should have done first, sorry). I also want to make sure that I understand all this right.

First, port 110 was an oops. The line should have read...

iptables -t nat -A PREROUTING -p tcp --dport 80 -i ppp0 -j DNAT --to 192.168.2.40:80

All I did was copy a line out, and change the ports. Port 110 is for email.

Now, I have tried to change that line.

iptables -t nat -A PREROUTING -p tcp --dport 80 -i eth0 -j DNAT --to 192.168.2.40:80.

I am semi confused though. If I can ping mydomain.com, and I get my IP address, how come I cannot access it through http? That is still not making any sense.
 
Old 05-06-2004, 06:20 AM   #4
TheIrish
Member
 
Registered: Oct 2003
Location: ITALY
Distribution: Debian, Ubuntu, Fedora
Posts: 137

Rep: Reputation: 15
Now that you changed that line, can you see the website, at least inside the lan?
By the way, for this specific command, you might forget about interfaces:
Code:
iptables -t nat -A PREROUTING -p tcp -d $EXTERNALIP --dport 80 -j DNAT --to 192.168.2.40:80
iptables -t nat -A PREROUTING -p tcp -d $INTERNALBOXIP --dport 80 -j DNAT -to 192.168.2.40:80
When you ask your firewall box for port 80, doesn't it always mean "always DNAT to 192.168.2.40", indipendently if you're inside or outside?
Let me know if it works... it's intriguing...

Last edited by TheIrish; 05-06-2004 at 06:42 AM.
 
Old 05-06-2004, 12:11 PM   #5
mpgram
Member
 
Registered: Sep 2003
Location: Dallas TX
Distribution: Red Hat
Posts: 59

Original Poster
Rep: Reputation: 15
One problem is that I have a dynamic IP address. So setting the ip address with iptables isn't that easy. I can see the website fine if I am internal, I just have to call the internal IP (ie http://192.168.2.40). That works fine. When I call the domain http://www.domainname.com, I get the error.

Quote:
When you ask your firewall box for port 80, doesn't it always mean "always DNAT to 192.168.2.40", indipendently if you're inside or outside?
In theory you are correct. But apparently, it does not work that way.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
router issue (accessing local webserver) FliesLikeABrick Linux - Networking 4 11-25-2005 11:43 AM
Can access local LAN Webserver, but not Internet spaceuser Debian 11 08-23-2005 12:54 AM
Local webserver -- How to deny all client install their local web server--Please help b:z Linux - Networking 13 04-16-2005 07:11 PM
webserver behind a firewall with iptables Raphael_T Linux - Security 17 04-28-2004 03:08 PM
newbie setting up lan - can't see local webserver. nmoog Linux - Networking 1 03-27-2004 11:17 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 03:34 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration