access to hosted servers inside the firewall from inside vs outside
hanasaki
hanasaki at hanaden.com
Wed Jun 9 01:42:03 CDT 2004
All,
Below is an ASCII diagram of a network (mine). The goals are:
allow internet based clients http access to the domain hosted inside the
firewall. This is working fine with NAT on the firewall for port 80
incoming. External hosts lookup www.domain.com via the external dns
server and get the firewall address.
allow internal based clients http access to the domain hosted inside the
firewall. This is working because the internal hosts use the internal
dns to resolve www.domain.com for internal clients. This resolves to
the internal host's address (a CDIR). It would be ideal to remove the
need for separate internal/external dns management of the same domain.
The original approach was as attempt to have the firewall iptables rules
bounce port80 traffic to the IP of the external www.domain.com back to
the internal http server address. This was never accomplished and was
also avoided, in the end, due to the extra, unnecessary, traffic to the
firewall (ie: hit the firewall internally just to bounce it back) The
use of the internal dns to resolve www.domain.com to the internal server
also makes it impossible to find the external ip address for
www.domain.com from an inside host (good for internal users/bad for
admins that need to find the address and verify it)
send internally sent email at domain.com using the smtp servers for the
domain on the outside of the firewall and not require any internal smtp
special configs. Not a clue how to do this.
Any thoughts on how to accomplish what is desired, above, or how to set
things up differently, so it can be done, yet maintains the premise of
the below diagram?
thanks.
internet
smtp-server-for-domain
dns-server-for-domain
^
|
|
v
firewall-Linux-with-NAT
bind9-dns
dns-lookup-for-internet
^
|
|
v
internal-servers
bind9-dns
dns-lookup-for-internal
dns-lookup-for-internet-forwards-to-firewall-dns
internal-hosts-use-this-for-dns
______________
http-server
hosts-internal-only-websites
hosts-external-web-sites
available-to-outside-via-firewall-NAT
supporting virtual domains on one IP
______________
smtp-server
hosts-external-domain-email
available-to-outside-via-firewall-NAT
available-to-inside
More information about the Kclug
mailing list