raul, edu.ar doesn't resolve so none of the rest of the fqdn will either. the domain doesnt even resolve...whois from internic.net reports that the edu.ar subdomain doesn exist or is lame. Whois Server Version 1.3 Domain names in the .com and .net domains can now be registered with many different competing registrars. Go to http://www.internic.net for detailed information. No match for domain "EDU.AR". >>> Last update of whois database: Wed, 9 Feb 2005 07:51:57 EST <<< -----Original Message----- From: netfilter-bounces@xxxxxxxxxxxxxxxxxxx [mailto:netfilter-bounces@xxxxxxxxxxxxxxxxxxx]On Behalf Of Jason Opperisano Sent: Wednesday, February 09, 2005 2:45 PM To: netfilter@xxxxxxxxxxxxxxxxxxx Subject: Re: multiple webservers behind iptables On Wed, 2005-02-09 at 13:24, Raul I. Becette wrote: > Hello list > > This is my first post. > I am in charge of a LAN connected to internet through a firewall box > PIII 500MHz with iptables 1.2.10. > > There are different internal webservers that I don't adminnister and are > located physically in different parts of the building. > There is an internal DNS server which I administer to resolve internal > www queries. > > My problem is that from the outside I cannot access those webservers > when I type www.xxx.unp.edu.ar (xxx being the name of the server). > My net schema is the following um--not to be silly, but does www.xxx.unp.edu.ar resolve to an IP address externally? > INTERNET > Mail Relay Main Web Server Router > > > -------------------------Firewall-------------------------------- > > > POP Server Proxy Webserver1 Webserver2 > LAN > > My question is how can I use iptables rules to be able to access those > servers from the outside. depends on whether you need to use NAT to make the servers accessible from the Internet (i will assume you do not). for each webserver IP, add a rule like: iptables -A FORWARD -i $EXT_IF -p tcp --syn -d $WEB_SRV_IP \ --dport 80 -j ACCEPT this assumes that somewhere above this rule you have: iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT -j -- "Me fail English? That's unpossible." --The Simpsons
