Date: Mon, 13 Feb 2006 14:53:26 -0500 From: Brian Bobowski <bbobowski@gmail.com> To: Norberto Meijome <freebsd@meijome.net> Cc: FreeBSD User Questions List <freebsd-questions@freebsd.org> Subject: Re: Firewall/Web server difficulties Message-ID: <43F0E3B6.9080407@gmail.com> In-Reply-To: <43F098D1.2000708@meijome.net> References: <43F0935B.4020901@gmail.com> <43F095E6.2070901@meijome.net> <43F097BC.80308@gmail.com> <43F098D1.2000708@meijome.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Norberto Meijome wrote: >Brian Bobowski wrote: > > >>I'm poking at that now, yes. I had difficulty getting it to work with >>virtual hosts... but I can at least reference it by the private-side IP >>address and get places. >> >> > >assuming you are using Apache, you can use * for Ip address and let it >be name-based virt host. > > Already running thus. DNS seems to be the problem, then. (Which I'll poke at later assuming hosting alternatives don't work out.) >>WAN. People have tried pinging and browsing, with no success. >> >> > >then I would review the rules... > > Relevant rules text(and based on both startup text and behaviour of the firewall for other tasks, I know the rules file is being parsed) excerpted below: --- cmd="ipfw -q add" pif="rl0" #Interface which opens to the WAN; NAT interface prif="ed0" #LAN interface, private-side ks="keep-state" # More stuff here... $cmd 400 allow udp from 24.226.1.121 to me 68 in via $pif # DHCP server $cmd 401 allow tcp from any to me 80 in via $pif # Apache $cmd 402 allow tcp from any to me 22 in via $pif # SSH $cmd 403 allow icmp from any to me in via $pif # For testing; low-traffic, not worried about ping floods at this time --- The firewall's DHCP requests are working fine, so #400 is working properly. Other machines, however, cannot see it. These firewall rules are essentially a slightly-modified copy of the first example NAT ruleset in the handbook's IPFW section. The modifications consist of extending the 'good-tcpo' variable to a few more ports I want to use, putting more entries for my ISP's DNS servers, adding DHCP outbound and inbound permission 967 and 68) like the second example has, and adding port 22 and ICMP in the above set. That's one problem. The other is DNS. I'm still looking through the named.conf file and poking at the settings given for a secondary server... all I really want is a caching server that will first look at my own /etc/hosts file (where the domain names which refer to this machine are specified by their private-facing address). Any assistance, as always, appreciated. Especially with the first problem. (Off-list as I can't keep up with the volume of list delivery.) -BB
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?43F0E3B6.9080407>