Re: port redirection with natd and ipfw

[Nilton Volpato]

[Fratiman Vladut]

This is because u try to access an ip that have same ip like your
gateway, but from internal lan, so packets are sends to gateway but
cannot be redirected back to the http server according with redirect
rules.
To resolve this situation, configure a simple dns server on your
gateway, and make a zone with your domain pointed to the internal ip.
Then configure the computers clients to ask your dns server. This is
easily done via dhcp.
Your dns server need to be configured to forward request's for unknow
domains to the autoritarive public dns servers.
--
Best regards,
 Fratiman


[Russell Wood]

I had a similar setup once and used Split DNS with BIND. So, if you
requested example.com on 192.168.0.0/24 then you'd get the internal IP,
otherwise you got the external IP.

Regards,
Russell Wood


Thanks guys,

But Split DNS does not work in my case. Because I have different
services on different machines, and the dns will map one name (and all
ports associated to it) to one machine.

Is there any solution that will work without using split dns?

Thanks,
-- Nilton
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]

Re: port redirection with natd and ipfw

[Frank Shute]

On Sat, Nov 18, 2006 at 09:12:30PM -0200, Nilton Volpato wrote:

 Hi,
 
 I'm using a computer with FreeBSD as a gateway and NAT for a private
 LAN. Let's say the gateway has external.com as external address, and
 192.168.0.1 as internal address, so that the LAN is 192.168.0.0/24.
 
 I'm doing a number of port redirects in the gateway, for svn, http,
 https, ssh, etc using natd. However, these port redirects do not work
 from inside the LAN.
 
 For instance, if I point my browser to http://external.com and I'm in
 the LAN, then it will not work. I can't use the internal address of
 the web server because none of the links will work on the web page.
 
 In summary, I want that my port redirections work also when I try to
 connect to the gateway's external address from inside the LAN.
 
 I'm using a minimal ipfw configuration to try to solve this. This is
 the default configuration.
 
 00050 divert 8668 ip4 from any to any via vr0
 00100 allow ip from any to any via lo0
 00200 deny ip from any to 127.0.0.0/8
 00300 deny ip from 127.0.0.0/8 to any
 65000 allow ip from any to any
 65535 deny ip from any to any
 
 I tried to add:
 
 00060 divert 8668 ip4 from 192.168.0.0/24 to external.com
 
 expecting that it would send the packets from LAN to natd, which would
 apply the port redirections. But it did not work.
 
 How can I solve this?
 
 Thanks,
 -- Nilton

What I do in these circumstances is put a line in /etc/hosts on the
machines on the LAN eg:

192.168.0.1 external.com

If you've got a standard host.conf then it gets picked up before bind.

Whilst it means you don't connect to the external interface of
external.com it has the same effect and you can browse your site etc.

No fancy firewall rules required either.

HTH.

-- 

 Frank 


echo f r a n k @ e s p e r a n c e - l i n u x . c o . u k | sed 's/ //g'

  ---PGP keyID: 0x10BD6F4B---  
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]