Connection Refused network porblem

Hi Experts

I have the following porblem. A firewall with 3 nics does the routing and filtering.


INTERNET
|---------------|
|----------| |----------|
|eth0 ISP_1| |eth1 ISP_2|
|----------| |----------|

routing iptables nat DNS

|----------|
|eth2 local|
|----------|
|
|
|-------------------|
|----------| |----------|
|eth0 www01| |eth0 www02|
|via ISP_1 | |via ISP_2 |
|----------| |----------|

Everything is working, expect the connections from www01 to www02 over the firewall. From the Internet can I access all

servicses.
If a user want to access a service (telnet mydomain 25) running on www02 is an error saying: Connection Refused

Whats wrong does anybody have suggestions..

Sorry for my english...

Regards Rene

Looks like you need split routing in the firewall, supplied by the iproute2 package..
(which you probably have installed already..)

The Advanced Routing HOWTO explains more in chapter 4

Thank you Peter for respond...

I already configured the spliting. Should I post my scripts. So maybe you can see more?

Thx again
Rene

So, is the problem with internal users trying to talk to www01 & www02 using the external url names or ip addresses?

not exactly...
for example a user on www01 want to send an email to an other user on www02. Then gives in the log a messages "Connection Refused".
So I tried to connect via console form www01 to www02 with the following string " telnet mydomain 25" (mydomain is for the real DNS Name). Then also gets an error "Connection Refused"
Both servers are webserver the users can acces, with a webmail tool.
BTW "telnet mydomain 80" results the same error

Regards
Rene
Thx for helping

That's what I needed to hear!

If you use the full domain name of a server behind a router/firewall that has a local address, there is a routing loop...
You send to mail.domain.biz (eg 123.456.789.111), the firewall finds the server and routes you to www01 at eg 10.x.x.1
www01 sees an incoming mail request from www002's local ip 10.x.x.2, knows it is local and sends it's reply locally, directly...
Problem occurs when www02 gets a reply from 10.x.x.1 rather than 123.456.789.111 & drops it...

I have tried various iptables snat/dnat rules to get around this, but found the easiest was to install dnsmasq.
This uses the firewall/router's /etc/hosts file to help resolve names.
In there I place all the used url names against the local ip number of each www~ machine.
Then place a redirect rule for dns requests from local connections to use dnsmasq on 127.0.0.1
dnsmasq will use the dns nameservers listed in /etc/resolv.conf

I will give that solution a try

thx again
Rene