4

I have problem accessing (one of my) web server from my local network.

I have a (Ubuntu) computer that that acts as router, web server etc. That works well, I can access the web server both externally and from the internal network. I can also access computers on the internal network via ssh from the outside (re-direction with iptables).

Now I have another web server on the internal network. I have made some routing paths with iptables. If I in the browser type some.webadress.com:40080 it should go to the “internal” web server.

This works:

  • Access the internal web server with the domain name (+port) from an external network
  • Access the internal web server with the internal IP number (+port) from the internal network

This does not work:

  • Access the internal web server with the domain name (+port) from the internal network

I'm pretty sure that the routing part works ok. The question is if I have to have a DNS or is it something that I should add/change in my /etc/hosts file?

EDIT: Some clarification. The device/webserver that I'm having problem to reach is a webswitch. The webswitch is a device that makes it possible to control a number of high-voltage relays (e.g. car heater, external lights etc.) via the web/phone app. The problem arises when a smartphone is used. If I'm on the 3G net, I use some.webadress.com:40080 (note that I use port translation) and if I'm on the home-wifi I must use 192.168.0.101:8080. What I want to use is some.webadress.com:40080 regardless if I'm on the local net or an external net.

(The better half in the family is not that interested in technical stuff so having to swift addresses is actually an issue :)

3 Answers 3

1

Other machines in your network will reach the web server without passing your router; it's in the same local network. You should be able to access your web server from the internal network directly using its IP address, e.g. http://192.168.0.101:8080. I assume that you don't do port translation and your web server runs on the same port on the machine as you configured your router to forward it from.

If that works, then you'll only have to tell your machines to talk to 192.168.0.101 when resolving the name some.webadress.com. This is something you should be able to configure on your local DNS server (might be running on your router). You should also make sure your machines in the local network are always using this local DNS server.

For example, if you would set up a DNS server in Ubuntu using dnsmasq, it will load the /etc/hosts file on this machine by default, so putting a line

192.168.0.101     some.webadress.com

would be sufficient.

Alternatively, edit the /etc/hosts file on all machines to overrule the answer from DNS. That's a lot harder to maintain, especially when it's about a larger number of machines.

2
  • The problem is that some.webadress.com should not always go to 192.168.0.101, only when port 40080 is specified (I use port translation, changed in the original post). Your first sentence is interesting, but can I make it the other way around? Can I force all machines on the local network to go via the router? (maybe not very efficient, but there is not that much traffic)
    – mazellan
    Dec 29, 2012 at 11:31
  • No, the idea of a local network is to not have the traffic passing any router. Learn more about basic networking if you don't understand this. The only option I see here is to have your router send a REDIRECT ICMP reply if you want to connect to some.webadress.com at a specific port. This is very inefficient, rather complicated and not the way to solve this. One should use symmetrical port numbers and split DNS in this case. Remember that the host part in an URL points to a host. Don't abuse port numbers for this!
    – gertvdijk
    Dec 29, 2012 at 12:18
1

hosts file will work well and there is no need to build a DNS server only for that in my opinion.

Another way you could consider is making an alias for the webserver virtualhost using an internal name (hostname, hostname.local or hostname.internal.domain, depending on how is your LAN configured) that can be resolved locally without DNS server. This way local machines will be able to access it directly, without using the external IP / router path.

Comments after clarification in original question:

If you want to use the same URL on both networks (3G and wifi), using an internal name different of the external one is ruled out as it will be a different URL.

What you may be able to do is to change the hosts file based on the connection you use: One hosts file for wifi (converting the URL to internal IP of the server) and one for 3G (converting to external IP). You can do this with automatic scripts on a computer (running Linux at least) but I have no idea on a smartphone.

When you use some.webadress.com:40080 with the wifi connection, your router doesn't route internal traffic using external addresses. This is one of the purpose of a LAN, to be isolated from public network.

  • I suppose you made the forward in iptables using the input interface and not the destination IP as it is probably dynamic but if you have a fixed public IP, if you use the destination IP + port (your public IP) instead of the input interface + port for the rule, it should work the way you want I think. Anyways, you can try it temporarily using the IP you have at the moment of the test.

  • If your IP is dynamic, you have to use the interface as input for the iptables forwarding rule so you may try to forward to the internal IP of the webserver when it comes on the internal interface too instead of only the external one.

  • Another option you could try is using the port and source 0.0.0.0/0.0.0.0 to forward using iptables.

1
  • This sounds like an interesting solution. But I'm afraid that my knowledge is limited in this area, could you give an example? (I added some clarification to the post too)
    – mazellan
    Dec 29, 2012 at 11:25
1

Looks like what you want to achieve is NAT loopback. Found this guide:

http://for-invent.com/nat-loopback-using-iptables/

Something in the line of:

iptables -t nat -A PREROUTING -s 192.168.0.0/24 -d some.webaddress.com -p tcp --dport 40080 -j DNAT --to-destination 192.168.0.101:8080
iptables -t nat -A POSTROUTING -d 192.168.0.101 -s 192.168.0.0/24 -p tcp --dport 8080 -j SNAT --to-source some.webaddress.com

Not 100% sure about the --dport value in the POSTROUTING rule though, if the above doesn't work, try with 40080 instead.

Good luck.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .