i have this in dns...before 2 last updates all was working perfect and now i cant get whats changed...

If the DNS is as BAlfson suggested, then you could check things on your clients to see if something has gone wrong there. I don't know why your problems appear after 2 upgrades, so I'm just suggesting as if the problem has allways been there, perhaps it will give you some answers.

If you use 'nslookup "servername.domainname.com"', does it return 192.168.4.5 or does it return 80.74.100.12 ?

If it does return the latter, then you could check if your DNS server is still the DNS server that has the modifies FQDN for internal use (ipconfig /all)

You could also try (for debug purposes) to add the following line to %WINDIR%\system32\drivers\etc\hosts:

192.168.4.5 servername.domainname.com

And see if that give you any results

You could also check (if DNS and everything is OK) that local IP adresses and the FQDN of your server are excluded from the proxy in your browser. If this is not the case, and adding the exclusion helps, then Astaro could have wrong DNS settings. Another way to check is to add your FQDN to the hosts file like I described and then turn proxy off in your browser. If that still doesn't give you a reply from the server then the problem is likely with the server and you could check that config.

->If you use 'nslookup "servername.domainname.com"'
this one return 192.168.4.5

server by himself exit to network with 80.74.100.10
its all ok like it must to be....
u can try enter by yourself to http://80.74.100.12:7099
that is a server and accessible from outside but not from inside on this ip
if from inside i type http://192.168.4.5:7099 i can acsess this too
but why i cant on 80.74.100.12

If 'servername.domainname.com' internally resolves to 192.168.4.5, then the best thing to do is to avoid using Astaro for connecting to your server for internal clients alltogether. It's just using CPU on the Astaro for no reason (assuming you trust your internal clients ).

It should work if you would add 'servername.domainname.com' to your proxy exception list in your browser (could be done using Windows Polices so you don't have to manually change all computers ). If I'm not mistaken, then your browser should see that servername.domainname.com is not going to be resolved through Astaro, resolve it internally (which would then be 192.168.4.5) and then connect to in directly.

Generally speaking I would not use Astaro to connect to internal servers / computers. Astaro is there to protect us from the outside world. If you acces your internal servers with their FQDN (so that it won't make a difference if you connect from the outside or internally) than there should be no need for your internal machines to connect to the internal server with the external address instead of the FQDN.

10x all for help.

that what i do...but i just want to understand why it worked for about a year and suddenly stopped.

Hello All,

I am having the same issue as well. I am running both 7.306 and 7.404 at two different locations and they are both experiencing the problem.

For example.

-The External IP on the Astaro is 65.64.2.1 (I have only 1 Ext IP in this case)
-The Internal IP on the Astaro is 192.168.1.254
-I have a webserver running at 192.168.1.250
-The external web address is testme.com (Points to:65.64.2.1)
-I have created a DNAT rule saying ANY->HTTP->ExternalIP->192.168.1.250

A user on the internet (from the outside world) accesses testme.com and is able to get to my webpage.

A user on my internal network at 192.168.1.100 attempts to access testme.com and gets the "Could Not Display Webpage" or "Network Timeout".

I have tried turning off IPS. No Luck. I have tried turning off the proxy. No luck. I have monitored the logs and cannot see ANYWHERE that this issue is being logged.

This has been happening for quite a while but is now becoming bothersome as we can't set our internal users homepage to our companys website because they can't access it internally.

I hope that helps explain why "we" need to be able to do this.

__________________
John K. Boslooper
Senior Network Administrator
Sygnetics, Inc.

John, did you try the DNS change I suggested on page 1 of this thread? If that didn't work, then try the things khardeveld suggested on 7-11, above. Problem solved?

Cheers - Bob

__________________
ACE V7 - Astaro Preferred Partner since V3
Addicted to my iPhone!

I understand what you were suggesting for the DNS changes. I also understand that doing it this way would cause the traffic to go out of the firewall and back in taking up resources on the Astaro itself.

When I use NSLOOKUP to resolve our companys website, it resolves to the external IP of the Astaro (Which is correct).

Any other firewall on the market allows this traffic to be sent out and back in. Why does the Astaro not?

We don't use the Astaro for DNS forwarding or resolving as we are in an AD environment and require the use of our AD-integrated DNs servers.

I cannot simply add a host entry for our external website because the external domain name differs from the internal domain name. I would need to create a dual home DNS solution which is not in our plans as of right now.

As I said, Any other cheapy firewall works just fine doing this.

192.168.1.10->65.64.2.1->65.64.2.1->192.168.1.250

The Astaro does not do this, and there isn't a clear explaination of why or how to log this issue to attempt to troubleshoot it.

__________________
John K. Boslooper
Senior Network Administrator
Sygnetics, Inc.

I'm confused by your comment, "I understand what you were suggesting for the DNS changes. I also understand that doing it this way would cause the traffic to go out of the firewall and back in taking up resources on the Astaro itself."

Maybe the following will help...

If you are not using the Astaro DNS proxy and want to use only your internal DNS server, create a 'Forward Lookup Zone' named "testme.com" and add an 'A' record pointing www at 192.168.1.250. The same thing can be done, for example, with outlook.testme.com for Outlook Web Access where you want a consistent URL from inside or outside your network.

Cheers - Bob
PS You can get more utility out of the Astaro and not change your use of your internal DNS:

1. Activate the Astaro DNS Proxy by adding your internal DNS server to 'Allowed Networks' on the 'Global' tab, and be sure that the forwarders listed in your internal DNS are added on the 'Forwarders' tab.
2. On the 'DNS' 'Request Routing' tab, add a route: '1.168.192.in-addr.arpa -> [internal DNS server]'.
3. In dnsmgmt on your internal DNS server, replace the forwarders with the internal IP of the Astaro, 192.168.1.254, as the single forwarder.

Now, you will have internal names instead of IP addresses in your reports.

__________________
ACE V7 - Astaro Preferred Partner since V3
Addicted to my iPhone!