At 04:28 PM 12/2/2003 -0500, Tibbs, Richard wrote:
Dear list. I am running a roughly 2-year old version of Dachstien (floppy boot) as a firewall through a DSL connection. I recently added a windoze 2003 server machine to my internal net, and set up IIS on it. My ISP has given me a static IP, and I want to serve web from the W2003 box. I looked through the mail archives and found several helpful remarks, which I followed. Everything works from clients on the internal network, access to web, as well as access to the win2003 home page via the internal ip address.
If I hook the win2003 server directly to my DSL modem (configure the NIC with the static IP), I can get my home page from any other location (say work).
Note that this eliminates one question we always ask -- does the ISP block port 80? Apparently not, in this instance. Good.
But, if I put the web server on the internal network, behind the firewall, I get a DNS Error/server not found page from work.
Putting the *web* server behind a firewall gives you a *DNS* error? !!? Are you sure you are reporting this error exactly as you see it? Is this same "win2003" host perhaps providing *external* DNS for whatever FQN is in the URL involved? So far, this part of your report just does not make sense.
Changes that I made to the default network.conf (via lrcfg) are as follows:
These are hard to comment on properly, since you chose to obfuscate some of the information. I'll do my best, given the limitations that your decision imposes.
ConfigDNS=YES eth0_IPADDR = <static ip/26>
This should be an address, not a network. That is, it takes the form
eth0_IPADDR=a.b.c.d
not the form
eth0_IPADDR=a.b.c.d/netmask
You set the netmask on the next line, as (apparently for your setup)
eth0_MASKLEN=26
EXTERN_DHCP=NO EXTERN_TCP_Port0 "0/0 www 192.168.x.y/24
This entry needs a closing quotation mark. And it should be EXTERN_TCP_PORT0, not EXTERN_TCP_Port0 -- case counts here.
INTERNAL_WWW_SERVER=192.168.x.y
This isn't the usual approach, in that you specify the port-forwarding destination twice. Assuming they both match, that shouldn't be a problem, though I don't know offhand which of the two specifications will "win".
A more typical way to do it would be:
EXTERN_TCP_PORTS="0/0_www"
INTERN_WWW_SERVER=192.168.c.dand, firewall rules via weblet show port forwarding to my 192.168.x.y win2003 box.
Is the above sufficient? To enable an internal web server do I need to issue a ipfwadm or ipchains command after boot-up in addition to the changes mentioned above to network.conf?
No. But after you make these changes to the /etc/network.conf fle, you do need to restart networking (probably the best way is to backup etc.lrp, then reboot the router).
Or could this be a win2003 security policy issue?
That question needs to be asked of a Windows and/or IIS specialist, not a LEAF troubleshooter. (Well, the answer to "could" it be is Yes, of course. Or moving the Win2003 host behind the Dach firewall "could" somehow interfere with its ability to do DNS lookups. Or if the server uses redirects, the move "could" introduce problems with them. Lotsa "coulds" here. You need a Win2003 specialist to untangle them for you, though.)
------------------------------------------------------- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ------------------------------------------------------------------------ leaf-user mailing list: [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user SR FAQ: http://leaf-project.org/pub/doc/docmanager/docid_1891.html
