Forum OpenACS Q&A: Web site connection problem

Posted by Taka Chan on 09/12/01 05:44 AM

I am using cable modem at my home. And I have setup a Linux
gateway/firewall (Redhat 6.2) to share the internet connection to my
home LAN. Everything works fine.

Recently, I have setup a web site at one of my PC using AOLserver
(3.3+ad13) + PostgreSQL + OpenACS 3.2.5. I also configure my gateway
to redirect port 80 requests to my web server. But something strange
happens...

I find out that my site is reachable for users using direct
connection. However, if the user is behind a firewall or NAT server,
he/she cannot reach my site.

I also find out that for the users that can reach my site, they can
ping and establish ssh connection to my gateway. If the user is
behind a firewall/NAT server, my gateway is unreachable. "Connection
Timeout" for ssh and telnet. I am used to establish ssh connection
to other servers from my office, so I can sure that port 22 is not
blocked at my office. But I fails to connect to the gateway at my
home from my office.

I think my web site configuration has no problem and the cause of the
problem maybe due to the gateway. I am getting frustrated with it,
anyone can help? Thanks in advance.

p.s. Maybe this thread is off-topic, but I have asked this question
in many newsgroups and this problem still unsolved. I just do not
know how to fix it and hope that there will be some experts here can
help me. I apologise for any inconvenience caused.

2: Response to Web site connection problem (response to 1)

Posted by Kenny Chan on 09/12/01 06:24 AM

Hi Taka,

I assume you using IP masq with ipchains under RH v6.2? I think it would help others to help you if you post the ipchains and port mapping settings.

Sincerely,

3: Response to Web site connection problem (response to 1)

Posted by Taka Chan on 09/12/01 06:33 AM

YES, I am using IP masq with ipchains under RH v6.2. I will post my rc.firewall later today as I cannot reach my gateway at office, thanks.

4: Response to Web site connection problem (response to 1)

Posted by Jamie Ross on 09/12/01 04:08 PM

Part of the problem could be that the firewall rules for the clients prevent the connection, especially any of your URL's show up with port numbers outside 80 (which I have had happen). Certainly most firewalls will prevent telnet and even ping since many sites will open up 80 and thats about it.

5: Response to Web site connection problem (response to 1)

Posted by Taka Chan on 09/14/01 05:30 AM

Content of my rc.firewall:

/sbin/ipchains -F
/sbin/ipchains -P forward DENY
/sbin/ipchains -A forward -s 192.168.0.0/24 -j MASQ

/sbin/ipchains -F
/sbin/ipchains -P forward DENY
/sbin/ipchains -A forward -s 192.168.0.0/24 -j MASQ

EXTIP=`ifconfig eth0 | awk '/inet addr:/ { gsub(".*:", "", $2) ; print $2 }'`

/sbin/ipchains -A input -i eth0 -p tcp -s 0.0.0.0/0 80 -d $EXTIP/32 80 -j ACCEPT
/sbin/ipchains -A output -i eth0 -p tcp ! -y -s 192.168.0.100/32 80 -d 0.0.0.0/0 -j ACCEPT

/usr/sbin/ipmasqadm portfw -f

# The following ports are used by ICQ to receive files
/usr/sbin/ipmasqadm portfw -a -P tcp -L $EXTIP 2000 -R 192.168.0.102 2000
/usr/sbin/ipmasqadm portfw -a -P tcp -L $EXTIP 2001 -R 192.168.0.102 2001
/usr/sbin/ipmasqadm portfw -a -P tcp -L $EXTIP 2002 -R 192.168.0.102 2002
/usr/sbin/ipmasqadm portfw -a -P tcp -L $EXTIP 2003 -R 192.168.0.102 2003
/usr/sbin/ipmasqadm portfw -a -P tcp -L $EXTIP 2004 -R 192.168.0.102 2004
/usr/sbin/ipmasqadm portfw -a -P tcp -L $EXTIP 2005 -R 192.168.0.101 2005
/usr/sbin/ipmasqadm portfw -a -P tcp -L $EXTIP 2006 -R 192.168.0.101 2006
/usr/sbin/ipmasqadm portfw -a -P tcp -L $EXTIP 2007 -R 192.168.0.101 2007
/usr/sbin/ipmasqadm portfw -a -P tcp -L $EXTIP 2008 -R 192.168.0.101 2008
/usr/sbin/ipmasqadm portfw -a -P tcp -L $EXTIP 2009 -R 192.168.0.101 2009

/usr/sbin/ipmasqadm portfw -a -P tcp -L $EXTIP 80 -R 192.168.0.100 80

Two days before, something very strange happened. I have not done my configuration changes on my gateway, but I can connect to it from my office suddenly. During these two days, I had tried to connect to my gateway from office, sometimes fails but sometims success.

I really don't know what is going wrong, and the virtual domain of my site is bear.no-ip.com.

6: Response to Web site connection problem (response to 1)

Posted by Jun Yamog on 09/16/01 12:16 PM

Hi Taka,

I maybe able to help you as I have done a lot of this stuff. Although
I would need to understand your setup better. Anyway while I still do
not have the details here are the possible setups.

Setup A

- ACS site is on the local subnet (192.168.x.x). Local users can
connect but outside users cannot connect.

Working setup is. Have the internet DNS point to your firewall
(acs.site.com -> firewall IP addr). On the firewall forward port 80
to the ACS site. On the ACS server override the DNS name using
/etc/hosts. (acs.site.com -> 192.168.x.x). Also local users must use
the local naming (acs.site.com -> 192.168.x.x).

This is setup is pretty weird but let me explain. ACS request
processor for some reason will always make the IP address into DNS
name on each connection. If you do not override the DNS name via
/etc/hosts on the ACS server it will always resolve acs.site.com to
the firewall IP addr.

I am sorry if the explanation is confusing, I haven't got much time to
write and read you IPchains config. Anyway if you are confused just
email me I maybe able to help you.

Jun

7: Response to Web site connection problem (response to 1)

Posted by Taka Chan on 09/17/01 04:25 AM

Hi Jun,

Firstly, thanks for your help. But my problem is not related to my AOLserver. The main problem now is that my gateway machine is unreachable outside my home LAN, even ping returns "request timeout".

After testing, I think that the problem is due to routing issue of my home LAN. At my home, there are 1 gateway/firewall, 1 web server, and 3 PCs. Yesterday, I found out that when all of my 3 PC was being turned off, my gateway was unreachable from outside. Strangely, when I turned on any one of the PCs, my gateway was reachable again from machines outside my gateway/firewall.

Then I suspect that my problem is related to the routing policy of my gateway, am I right? If so, what can I do? Thanks in advance.