Arch Linux

scar

Member

From: Hungary

Registered: 2009-10-01

Posts: 449

Shorewall - reaching my server from the Lan.

I've installed a small router using arch and I've used shorewall to build it's firewall.
My problem is, that I have a server that I definitely can reach from outside my network,
but I want to reach it from the internal network too.

Here it is: My router has two interfaces ( LAN and WAN ). The WAN side has an fqdn name, and behind the firewall
I have a web server. I've used DNAT to forward requests to the server from the WAN.

It works as it should, but I cannot reach my server from the LAN using the same fqdn name.
I understand, that the name corresponds to the WAN interface of my router, and not to the server, but
is there any way to route requests from the LAN to the LAN for the FQDN name corresponding to my WAN interface???

---

“The future has already arrived. It's just not evenly distributed yet.”
― William Gibson

geekinthesticks

Member

From: England

Registered: 2011-09-21

Posts: 143

Website

Re: Shorewall - reaching my server from the Lan.

I am not sure if I understand your setup properly. However, I have:

Firewall (Ubuntu) <-> Virtual machine (running arch)

I can reach the VM from both the WAN and my local LAN using the same FQDN. If that's what you want to do, I can probably help.

As a start you probably want something like this in your shorewall policy file:

$FW     net     ACCEPT
loc	$FW	ACCEPT
$FW	loc	ACCEPT

loc             net             ACCEPT
net             all             DROP            info
# THE FOLLOWING POLICY MUST BE LAST
all             all             REJECT          info

Last edited by geekinthesticks (2012-04-16 08:11:00)