Very Computer

by **nosp** » Thu, 04 Oct 2001 06:45:37

Having a strange problem with a FreeBSD gateway/firewall system I set up.
The gateway connects a small network to an ADSL line and has three static
external IP addresses. I am using natd to provide access to the Internet
for computers in the internal LAN.

One of the machines behind the firewall is a web server and I use a natd
line similar to the following to route incoming connections to that box:

redirect_address 192.168.1.100 xxx.xxx.xxx.1

In this case the real IP of the web server is 192.168.1.100 and it is
accessed from outside the LAN by the address xxx.xxx.xxx.1. This works.

The problem is that if any of the computers on the internal LAN try to
access the web server at xxx.xxx.xxx.1 it doesn't work. I can access the
web server fine from inside the LAN using the local address (192.168.1.100).

I suspect there is a simple solution to this problem. Can anyone explain
what it is?

Thanks,
Don

by **Ludek Frybor** » Thu, 04 Oct 2001 07:09:29

> Having a strange problem with a FreeBSD gateway/firewall system I set up.
> The gateway connects a small network to an ADSL line and has three static
> external IP addresses. I am using natd to provide access to the Internet
> for computers in the internal LAN.

> One of the machines behind the firewall is a web server and I use a natd
> line similar to the following to route incoming connections to that box:

> redirect_address 192.168.1.100 xxx.xxx.xxx.1

> In this case the real IP of the web server is 192.168.1.100 and it is
> accessed from outside the LAN by the address xxx.xxx.xxx.1. This works.

> The problem is that if any of the computers on the internal LAN try to
> access the web server at xxx.xxx.xxx.1 it doesn't work. I can access the
> web server fine from inside the LAN using the local address (192.168.1.100).

> I suspect there is a simple solution to this problem. Can anyone explain
> what it is?

> Thanks,
> Don

Just a few guesses:
1) I guess that your divert rule in the firewall looks similar to this:
divert natd ip from any to any via <your_external_interface>

2) Then I guess that packets from inside the LAN to xxx.xxx.xxx.1 don't
meet the "via <your_external_interface>" criterion. Therefore natd never
sees the packets.

3) If I were you, I would try if it helps if you add an additional rule:
divert natd ip from 192.168.1.0/24 to xxx.xxx.xxx.1
(and maybe also:
divert natd ip from xxx.xxx.xxx.1 to 192.168.1.0/24
so that the return packets get to natd as well)

I really can't guarantee it will work, but it might be worth trying.

Ludek

Very Computer

FreeBSD and natd - routing from behind firewall to behind firewall.

FreeBSD and natd - routing from behind firewall to behind firewall.

FreeBSD and natd - routing from behind firewall to behind firewall.