Why cant I route public domains back to intranet

matbehns · #1 (**permalink**) 09-10-2009, 04:31 PM

Hi,

there is one issue I dont understand and I am asking myself wether I have a inoptimal configured firewall or the matter is simply not possible.

I am sitting in a LAN having on of the computers in the same network configured as webserver, reachable with a public domain.
If I surf this adress from the outside there is no problem - I can reach the webserver under ***.yyy.de.
If I am trying to reach the computer from the intranet using the public domain I cant reach it. If I use the LAN-adress it works fine.

So my question is, wether it is possible at all to route a request to a public domain outside and let it come back to my server?

Thanks,
Mat

BAlfson · #2 (**permalink**) 09-10-2009, 05:51 PM

The "accepted" solution for this would be to set up a static route in your internal name server or in the Astaro DNS Proxy: '***.yyy.de -> [internal IP]'. Here are some suggestions about how best to set up the Astaro DNS Proxy and coordinate it with your internal name server: http://www.astaro.org/120510-post9.html

Cheers - Bob

-renegade- · #3 (**permalink**) 02-08-2010, 09:45 AM

Hi!

I have the very same problem with my system. But there are three different machines in the LAN that should be reachable through the public domain name, with DNAT on their individual ports.

How can I tell Astaro to correctly redirect these packets?

BAlfson · #4 (**permalink**) 02-08-2010, 02:58 PM

I think you're asking a different question, renegade. Assuming that the Astaro is the default gateway for those three machines, you will need a DNAT for each machine:

'Internet -> {service (port) for machine 1} -> External (Address) : DNAT to {private IP of machine 1} (leave 'Destination Service' empty)

Cheers - Bob

-renegade- · #5 (**permalink**) 02-09-2010, 12:58 PM

DNAT is already set up and working from the internet.

The only problem I have is that clients from within the LAN trying to access the servers through the DNATted ports using the Astaro's DynDNS-Name won't get any respnse...

-renegade- · #6 (**permalink**) 02-11-2010, 08:49 PM

Hey guys!

Finally got the point!
Its NAT loopback what was needed.

Therefor a full NAT has to be configured in DNAT/SNAT settings..

More information here:

Astaro Knowledge Base

BAlfson · #7 (**permalink**) 02-12-2010, 12:12 AM

Actually, instead of NAT Loopback, we normally solve this with 'Static Entries' in the Astaro DNS Proxy.

Cheers - Bob

-renegade- · #8 (**permalink**) 02-12-2010, 09:52 AM

Yes, static DNS entries work fine if you're only using one single server.

But trouble starts when, you want to select different servers through port-mapping. DNS can't reslove ports into IP-addresses...

BAlfson · #9 (**permalink**) 02-13-2010, 02:12 AM

Ahhhhh! - you aren't using the web proxy! You are exactly right!

Cheers - Bob