LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 06-17-2004, 05:25 AM   #1
ultraav
LQ Newbie
 
Registered: Jun 2004
Posts: 3

Rep: Reputation: 0
webserver behind firewall and squid


i have a webserver behind firewall and squid, but i cannot access it from the computers in the lan. (the webserver is accesible from the outside)

what can i do to make it accesible from local computers?

tk u
 
Old 06-17-2004, 07:02 AM   #2
tanmaya
LQ Newbie
 
Registered: Sep 2002
Posts: 14

Rep: Reputation: 0
hi,

please make the position of webserver clear.
is it on the local LAN or it is connected to local LAN via the squid pc?

If on local LAN then check if u can ping the server.


Tanmay
 
Old 06-17-2004, 07:50 AM   #3
ultraav
LQ Newbie
 
Registered: Jun 2004
Posts: 3

Original Poster
Rep: Reputation: 0
The gateway is doing firewall+nat+proxy(squid) for the local network. It has a routable IP associated with a domain from no-ip.org. Incoming traffic from the internet to port 80 on my gateway is directed via iptables to the webserver inside the local network. (this works just fine)
The webserver runs on a computer within LAN :192.168.0.x
It responds to queries like "http://192.168.0.x" from computers within LAN (but only if the browsers are configured to "bypass proxy for local addresses")

My problem is that squid running on the gateway is blocking queries like "http://xxxxxx.no-ip.org" from the computers within LAN.

Is there any solution to this problem other than configuring each browser to bypass proxy for domain xxxxxx.no-ip.org and running a nameserver for the lan?
 
Old 06-17-2004, 08:45 AM   #4
linuxxed
Member
 
Registered: Feb 2004
Posts: 273

Rep: Reputation: 30
Quote:
Originally posted by ultraav
The gateway is doing firewall+nat+proxy(squid) for the local network. It has a routable IP associated with a domain from no-ip.org. Incoming traffic from the internet to port 80 on my gateway is directed via iptables to the webserver inside the local network. (this works just fine)
The webserver runs on a computer within LAN :192.168.0.x
It responds to queries like "http://192.168.0.x" from computers within LAN (but only if the browsers are configured to "bypass proxy for local addresses")

My problem is that squid running on the gateway is blocking queries like "http://xxxxxx.no-ip.org" from the computers within LAN.

Is there any solution to this problem other than configuring each browser to bypass proxy for domain xxxxxx.no-ip.org and running a nameserver for the lan?

have you looked at the ACLs in squid.conf? You can do almost anything there .. even regular expressions are allowed.

BTW are you sure it is the squid blocking it? Can you see it in the logs? Have you increased the squid logging to check (squid -k debug)? Can you ping your gateway?

It may be that www.no-ip.org is resolving to the external address and your internal machines cannot ping that address.
 
Old 06-17-2004, 09:10 AM   #5
ultraav
LQ Newbie
 
Registered: Jun 2004
Posts: 3

Original Poster
Rep: Reputation: 0
i have no experience working with squid, but the browser says
"
The following error was encountered:

* Connection Failed

The system returned:

(111) Connection refused

The remote host or network may be down. Please try the request again.

Your cache administrator is root. "


so....
 
Old 06-17-2004, 09:40 AM   #6
tibby
LQ Newbie
 
Registered: Jun 2004
Posts: 3

Rep: Reputation: 0
You can't go from the private LAN, out through Squid, then back in through Squid to the webserver, infact I know no proxy/firewall that allows this. What you do is create a stub zone in your internal DNS and reference www.no-ip.org with the local IP. This will tell your internal clients to go directly to the machine.

HTH,
Tibby
 
Old 06-17-2004, 06:08 PM   #7
peter_robb
Senior Member
 
Registered: Feb 2002
Location: Szczecin, Poland
Distribution: Gentoo, Debian
Posts: 2,458

Rep: Reputation: 48
You've got a classic routing loop..

A lan client resolves http://xxx.no-ip.org to your external address
Packets go from the client to the external interface which forwards by iptables rules to the www server in the LAN, however the source address is still a local client...
so the www server replies locally to the client , from it's local address.
The client expects replies from the resolved external address and ignores the local replies...

Install a lightweight dns proxy eg dnsmasq on the gateway, and create an entry resolving www.xxx.no-ip.org to the internal ip of the www server.
It's the same problem as browsing a dmz with internal numbers..
(Make the dns proxy listen on only the internal LAN interface)

Last edited by peter_robb; 06-17-2004 at 06:10 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
webserver behind a firewall with iptables Raphael_T Linux - Security 17 04-28-2004 04:08 PM
where does it go? sshd firewall or webserver? piratebiter Linux - Security 4 09-14-2003 11:41 AM
RH9 Firewall blocking webserver lsgko Linux - Newbie 3 08-17-2003 08:40 AM
Need Advice - Webserver and Firewall Setup nbin Linux - Networking 8 06-17-2003 08:55 AM
Mandrake webserver on NT network behind firewall slipsy Linux - Networking 1 02-10-2003 12:49 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 05:34 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration