0

I have a problem inside my infrastructure. chat.example.com port 8185 is reachable outside my infrastructure with a port fowarding to the right box. But inside my infrastructure, i'm not able to reach it.

root@node1:/etc/iptables# telnet chat.example.com 8185
Trying 91.x.x.x...
telnet: Unable to connect to remote host: Connection refused

and outside my infrastructure :

guilhem@guilhem-Lenovo-B50-30:~$ telnet chat.example.com 8185
Trying 91.x.x.x...
Connected to chat.example.com.
Escape character is '^]'.

I don't understand why i can't reach it from my infra...

Here is my iptables rules :

root@node1:/etc/iptables# cat rules.v4
# Generated by iptables-save v1.4.21 on Thu Nov 26 13:51:03 2015
*nat
:PREROUTING ACCEPT [1577:148565]
:INPUT ACCEPT [484:29040]
:OUTPUT ACCEPT [403:31487]
:POSTROUTING ACCEPT [47:2820]
-A PREROUTING -d 91.x.x.x/32 -i eth0 -p tcp -m tcp --dport 8185 -j DNAT --to-destination 10.0.100.30:8185
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Thu Nov 26 13:51:03 2015
# Generated by iptables-save v1.4.21 on Thu Nov 26 13:51:03 2015
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [4:407]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 8185 -j ACCEPT
-A INPUT -j DROP
-A FORWARD -i eth1 -j ACCEPT
-A FORWARD -d 10.0.100.30/32 -i eth0 -p tcp -m tcp --dport 8185 -j ACCEPT
-A OUTPUT -p icmp -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o eth1 -j ACCEPT
-A OUTPUT -o eth0 -j ACCEPT
COMMIT
# Completed on Thu Nov 26 13:51:03 2015

If you have any idea... Thank you !

1 Answer 1

1

Sounds like a DNS issue. You most likely setup your external DNS to point to your firewall/router (external IP). Your firewall then does an IP/Port forward to the correct IP on your network.

For this to work on your internal network, you will need to do a similar DNS setup. But you need to point the address to your internal IP address.

You can do it for your whole network via a DNS server you setup. Or if you only need this done for one computer then you can just make an entry into the HOST file of the computer:

sudo nano /etc/hosts

Then type: (according to this format IP HOSTNAME.DOMAIN ALIAS)

LIP.###.###.### chat.example.com example

LIP = the local ip address of the server you are trying to access

Then try to ping 'chat.example.com' and see if it points to the right IP.

ping chat.example.com

Be mindful that if you use the host file that this will only work on that computer. Any other computer on the network will have to have a similar entry on their host file. If you have many computers trying to access that, then it would be worth considering setting up a DNS server.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .