Review your favorite Linux distribution.
Go Back > Forums > Linux Forums > Linux - Networking
User Name
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.


  Search this Thread
Old 11-20-2007, 03:55 PM   #1
LQ Newbie
Registered: Nov 2007
Location: Winnipeg, Canada
Posts: 4

Rep: Reputation: 0
One webserver reachable, the other is not

We have, what I think, is a fairly typical 3-homed FW/DMZ setup.

If I can attempt crude ASCII Art:
Our SW1
Our FW
Our SW2
|              |
LAN            DMZ 
|              |  
desktops       public servers
Let's say for a moment if I have two servers in the DMZ (host1, host2) that are essentially the same hardware, OS, services running on them, etc.

From the internet then (like, from home), I can telnet host1:80 no problem, but I cannot telnet host2:80. The FW rule that passes *.80 to host1 is precisely the same as the one for host2 (I made a copy and changed the IP address). I've tried reloading and even hard restart of the FW.

I've broken out tcpdump and host1 sees tonnes of traffic. host2 practically none (ICMP and NTP stuff, but that's about it).

I've also looked at tcpdump on the FW itself, and I can't see any traffic that is destined for host2 (I do see it for host1).

If I then disconnect host2 from SW2, and put it right up on SW1 (beside the firewall, not behind it)... then the internet can now suddenly see host2.

Does this smell like a problem with the 'upstream provider', or might it still be something I need to do to either FW or SW1 ? (and what might that be?) I can't get past that tcpdump on FW saw no traffic destined for host2.. it makes me think it's an upstream problem.
Old 11-20-2007, 04:57 PM   #2
LQ Newbie
Registered: Nov 2007
Posts: 4

Rep: Reputation: 0
I know this sounds basic, but off the top of my head I'd delete the rule for your and instead of copying and changing the IP I'd manually enter it. I've seen FW's do goofy things with copied rules.


The other thing I'd do is first make sure your firewall and remote PC are fairly synched as far as time... Then make a request to host2, noting the time and see if there are any entries in the FW logs for that time.

Last edited by dholland; 11-20-2007 at 04:59 PM.
Old 11-21-2007, 02:39 PM   #3
LQ Newbie
Registered: Nov 2007
Location: Winnipeg, Canada
Posts: 4

Original Poster
Rep: Reputation: 0
I did try to create a new rule from scratch. That didn't work, so thought there might be some magic foo by copying an existing one that did work.

As far as firewall logs... I was in my datacenter, accessing host2 from our backup connection (so, to our network, I was coming "from outside"), and requesting the host2 website, and I just moved my head 20 degrees to the right, and watching for my traffic on a real-time tcpdump of the firewall. I was using "tcpdump port 80 | grep ''"

What could I get from a firewall log, that isn't going to first show up in tcpdump? I'm not being snide, I'm genuinely unsure. Would the FW decide to drop the packet , due to a FW rule, before tcpdump saw it? Was my invocation of tcpdump incorrect?



Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Detect internet reachable kotao_78 Programming 1 07-17-2007 10:18 PM
Network was Reachable, But ..... _ AsiF Linux - Networking 1 06-25-2007 11:06 PM
router in DMZ is not reachable saavik Linux - Networking 2 07-14-2006 05:30 AM
Getting a network not reachable in suse 8.1 TyrranzzX Linux - Networking 1 12-22-2003 09:59 AM
Router dies after while and is not reachable McBrain Linux - Networking 2 11-01-2003 01:09 AM > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 05:27 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration