Astaro User Bulletin Board
Go Back   Astaro User Bulletin Board > Astaro Gateway Products > Network Security: Firewall, NAT, QoS, IPS and more

Welcome to the Astaro User Bulletin Board.
If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 02-06-2004, 12:24 PM
Junior Member
 
Join Date: Sep 2003
Location: FREDRIKSTAD
Posts: 5
Default Dual WEB/MAIL server behind ASL FireWall

I have done a logical split of the interface for my webserver. In addition to the 192.168.1.1 interface I now have 192.168.2.1 too.
Old WEBserver is 192.168.1.2
Additional WEBserver is 192.168.2.2.
On the additional WEB-server I' doing a testrun of 42GO ISP-Manager, and during the testperiod I want to have a cpuple of test-sites on the 42GO server.
Both servers are running Debian, and on the old-one I have a few sites running already, based on VirtualHost in Apache.
One of the already existing sites I have moved over to the 42GO-server, but noone coming in from the internet can ever see this moved site.

HOW DOES ASL DECIDE WHERE TO FIND THE SITE ASKED FOR?
IS THIS POSSIBLE TO DO?

Feedback would be very much appreciated!

K. Regs.
Reply With Quote
  #2 (permalink)  
Old 02-06-2004, 01:36 PM
Senior Member
 
Join Date: Sep 2002
Location: Sweden,Moheda
Posts: 237
Default Re: Dual WEB/MAIL server behind ASL FireWall

Have you set new dnat rules and rules for the new one webserver?
Reply With Quote
  #3 (permalink)  
Old 02-06-2004, 02:02 PM
Junior Member
 
Join Date: Sep 2003
Location: FREDRIKSTAD
Posts: 5
Default Re: Dual WEB/MAIL server behind ASL FireWall

Yes, that is done. And I have also defined a new "Service" for this server. It seems like the new server is never checked when asking for the moved site.
I can't really see how this new server could be found?
I have also entered a new entry in Pcket Filter Rules, and the new server is the very first entry.
What could possibly decide on what server the request will end up?

K. Regs.
Reply With Quote
  #4 (permalink)  
Old 02-06-2004, 03:03 PM
AJo AJo is offline
Senior Member
 
Join Date: Mar 2002
Location: sweden
Posts: 140
Default Re: Dual WEB/MAIL server behind ASL FireWall

ASL is a layer 3 device and routing and forwarding is done based on logical addressing. Not by name.

ALternative sollutions:

1. If you have additional public ip:s to assign to the external ASL NIC. Do so and change the DNS record for the site. And of course some NAT and filter rules.

2. If you only have 1 static ip to work with.
alt. a) change the port for the new site or old site.
ex. old: 8080, new: 80 and set up the NAT rules
DNAT 8080 ==> old server
DNAT 80 ==> new server
Of course the remote host need to address the old site with the additional port info (http://oldsite.com:8080)

alt. b) Set up the reverse proxy module for Apache to redirect the remote client to correct webserver based on the dns-name. Ie. www.oldsite.com ==> old web server, www.newsite.com ==> new webserver.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT. The time now is 12:55 AM.

 

Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2010, Jelsoft Enterprises Ltd.


These pages are specifically maintained for the discussion of firewall issues within the Open Source community, and might already reflect new alpha/beta releases under development. Please refer to our product specifications for the functionality of the actual release. Discussions of new/enhanced functionality does not constitute a commitment of Astaro, to integrate this functionality into future releases. issues within the Open Source community, and might already reflect new alpha/beta releases under development. Please refer to our product specifications for the functionality of the actual release. Discussions of new/enhanced functionality does not constitute a commitment of Astaro, to integrate this functionality into future releases.