07-03-2002 08:29 PM - edited 03-08-2019 11:22 PM
We are using a PIX515E (IOS 6.1(3)) with a "dmz". The DMZ has a single web server which is hosting multiple web sites. The web server uses a single private IP address, and each web site has a different public IP address. We have configured the PIX with the following for each web site :-
static (dmz, outside) tcp website_public_IP www webserver_private_IP 808x
Therefore each website "public" IP maps to the corresponding web server "private" IP / port combination (eg, 192.168.1.1 port 8082) on the DMZ. An access list has been configured to allow access from the "outside". ALL web sites are accessable from the Internet.
However, when we try to access the websites (on the DMZ) from "inside" hosts, DNS resolves to the correct "public" IP for each website, but the website cannot be opened. All other Internet sites can be accessed.
It seems like the packet entering the "inside" interface is NAT'd to the correct "public" IP address, but then the source & destination address are on the same "public" network. Because the packet does not enter the "outside" interface, then the static mappings to the DMZ based webserver do not occur.
We cannot use the "alias" command, as this does not work at the port level - only at the IP address level.
Does anyone know how to allow access to these multiple web sites on the DMZ from "inside" hosts ??
07-05-2002 09:15 AM
firewall will not allow the same packet to get out and get in to the same interface. So, you need to browse the webserver by the private IP
what i will do is, supose this.
you could add a traslation and a static route to reach the servers without leave the pix.
with a new nat on the inside, a global on the dmz and a static route
suppose this
nat (inside) 1 0 0
global (outside) 1 pool1
route outside 0 0 next_hop_ip
(until here, the nat that will allow the inside network reach internet)
then , the statics that you have declared for the dmz->outside
Now, the ones ill add to reach the webserver with the IP that DNS gave me for the Website (suppose the websites public IP as 200.0.0/24)
and make the static pairs to put the 192.168's on the inside interface with the public ip
static (dmz,inside) tcp 200.0.0.2 www 192.168.1.2 808x netmask 255.255.255.255
and so on.
now you have the same traslation in both interfaces (outside and outside) from the dmz interface.
i think that the default route is
route outside 0 0 next_hop
so , you can reach internet from the inside
now, the dns gave me for www.server1.com the ip 200.1.1.2 , i must avoid this packet leave the pix.
a static route could avoid it
route dmz 200.1.1.0 255.255.255.0 ip_dmz_interface
the traslation will set up by the static, all the other IP will leave the pix and go to internet, only the packets for the webserver will hop from inside to dmz.
Dont forget to add the acl statements for the inside access-group to permit this traffic.
This is an idea, i think it may work, but im with exams now , and i cant test it.
I hope it helps.
Alexis
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide