HTTP through Packet Filters..

Dr_Jones · #1 (**permalink**) 02-20-2004, 10:52 PM

This would seem pretty straightforward, however, all attempts at making this work has failed. Even in the Live Log, it shows the packets being accepted, yet the page fails to load. To avoid excessive filters for DNS, I am simply trying to browse to a webserver via IP.

Packet filter: Any --> External network, anyservice, logallow.

No joy. Ive tried adding a second filter reversing the path in case these filters arent stateful. Still No joy.

External network is defined as our Class C Ipaddress block with a webserver assigned a routeable IP from the block.

Please tell me Im missing something simple.

Regards,
Jones

Overnet · #2 (**permalink**) 02-21-2004, 12:17 AM

If you have a http server behind ASL you must also have a dnat for webserver.

Lokk in here for set up a dnat for you webserver dnat

Hope it helps you [img]/images/graemlins/smile.gif[/img]

Dr_Jones · #3 (**permalink**) 02-23-2004, 03:01 PM

Thanks for the response. The webserver Im using isnt behind ASL. Packet filters arent working for anykind of HTTP browsing whatsoever. I was just using our own webserver so I could browse via IP instead of messing with DNS filters, thus further complicating the problem.

WmLongman · #4 (**permalink**) 02-26-2004, 08:27 PM

I don't fully understand your topology. Is your webserver's IP in "external network"? It sounds more like a routing problem. Is the web server's default route set properly? It might need a static route to use the firewall as the gateway for your internal network. That's the easy answer....

Bill

blueorder · #5 (**permalink**) 03-02-2004, 02:14 PM

I have somewhat the same problem...

Webserver/mailserver (one box) on DMZ behind ASL on dynamic IP cable connection...tried webserver/DNAT guidebook and a couple of suggestions found on the forums...as posted above, no joy [img]/images/graemlins/smile.gif[/img] .. ports not open (checked at grc.com) and server can't access outside world

I've been successful in setting up everything but this...so tired...oh so tired...

BTW, here's some of my setup...

network

Plik · #6 (**permalink**) 03-02-2004, 03:01 PM

It doesn't look like anyone really *read* Dr. Jones' post - he's not trying to run a webserver behind ASL but rather wants to access an external one by adding it directly TO ASL via definitions and packet filter.

Dr. Jones - if you figure anything out please post your fix, I have the same problem essentially and cannot for the life of me fix it [img]/images/graemlins/laugh.gif[/img]

Dr_Jones · #7 (**permalink**) 03-02-2004, 03:11 PM

Ok I knew it was something easy. The problem wasn't within the packet filters, but under NAT. I needed to set up a NAT rule to masquerade the internal network.

My NAT rule:

Internal Network -> all/all MASQ_External.

I couldnt figure out why all my logs showed acceptance of the proper packets yet no joy. Then it dawned on me that while the packets were getting out, they were trying to return to my non-routable , internal network.

You would think that this rule would be setup by default as it is the most basic of principles with any NAT router.

Hope this helps.

Regards,
Jones.