Topic: Simple Port 80 forwarding: did search, tried some things, please give me a hand?

[arne]

An external port scan to see if the port forwardings work. (And if there is some other frewalls or restrictions.)

https://www.grc.com/x/ne.dll?bh0bkyd2

[electroman00]

Based on current info given...

Since my crystal ball has a (50 mile range limit) please select

1 - SME server only mode (no firewall ahead)
2 - SME server only mode (external firewall ahead, SME on DMZ)
3 - SME server only mode (external firewall ahead, SME on LAN) (Firewall PF 80 to SME, NO PF on SME)
4 - SME server-gateway mode (no firewall ahead)
5 - SME server-gateway mode (external firewall ahead, SME on DMZ)
6 - SME server-gateway mode (external firewall ahead, SME on LAN) (Firewall PF 80 to SME, NO PF on SME)

From info given assume # 3 or 6 ???
While 2 or 5 are optimal.

What Firewall is currently ahead of SME.....brick (i.e. linksys etc.) or FOSS (i.e. smoothwall etc.)??

Assume FOSS...?

Is the NEW Host on SME LAN or External Firewall LAN..??

Can we see the results of....

 db domains show

Then we can see if the proxy is setup as it should be.

After the second solution, browsing to 192.168.1.1 stopped giving me the "under construction" default web page for the address of my server on port 80

Did you set that P.F. on SME or the firewall or both..?? (NO PF should be required ON SME)

Clear indication something is a foobar, the SME does not need the Fort Porword for #'s 3 & 6 above.

Port Forward ON SME will forward ALL 80 requests (including 'www.mySMEserver.xxx' and 'www.mySMEserver.xxx/server-manager')

Don't think that is what your looking to do here..?

Your looking to create a Virtual Host i.e.

 example.mySMEserver.xxx       and direct that     (not a redirect)    to a remote host (same/different subnet).

If the New Host requires external (wan) access via SME you need Step 3,..... internal subnet access only - omit Step 3.

These steps accomplish that and should not effect/redirect in any way...

    mySMEserver.xxx    or    mySMEserver.xxx/server-manager    or    xxx.xxx.xxx.xxx/server-manager

or their www counter parts that are reflected in the DNS records.



Step 1 >> Test/Verify New Host

Download superscan 3 (windoze) and port scan your new host, port 80 should be open.

http://www.foundstone.com/us/resources/proddesc/superscan3.htm

That will tell you the new host is ping-able and port 80 is open on the new host (both required).



Step 2 >> Setup Hostnames and addresses select 'remote' option.

Incidentally, the domain that was supposedly created in that solution never showed up in my domain control panel under server-manager.

The new host should appear under Server-Manager > Review configuration

Test new host via    NewHostName.mySMEserver.xxx      without www. prepended and while on SME's local subnet.

That confirms local access is working.

then

     (only if external (wan) access via SME is required to the New Virtual Host)



Step 3 >> Provide for external (wan) virtual host access via SME's proxy

Code: [Select]

db domains set proxypassdomain.com domain
db domains setprop proxypassdomain.com Nameservers internet
db domains setprop proxypassdomain.com ProxyPassTarget http://xxx.xxx.xxx.xxx/
db domains setprop proxypassdomain.com TemplatePath ProxyPassVirtualHosts
signal-event domain-create proxypassdomain.com
Post here the above lines you used so we can see what you setup and also the Hostnames and addresses setup.
It's very hard to offer advice without that imperative info...(shooting in the dark)

The above steps assume you have no special requirements.

Since the host is on a different subnet you will more then likely need a DNS record, if you are accessing the New Host externally via SME Server.

Side Note:

Set-ups # 4-6 above may be a preferred setup to better control access to the New Host via SME, which is in fact the purpose of the proxy (Hide Me) concept.

Sending the proxy to another subnet adds that subnet to the Hacker's subnet list (which you indicate your doing).

Hack SME and you have two subnet's for the Hacking price of one. (that's 510 possible IP's) when you only need to expose 255 IP's.

That's SME's subnet and the subnet you proxy to, which = 2 subnet's in the sys config on SME.

Proxy to a Client LAN and that's Hacker's Heaven.

Server's and Client Lan all in one shot....bam.

So.... # 5 suddenly becomes the winner.

If your external firewall can proxy then you would proxy to SME and proxy to New Host (different subnets) which provides subnet isolation.

Keep in mind any "Port Forwards" or "Pin Holes" may violate the subnet isolation.


Set-ups # 3 & 6 may not give much joy in the future (your mileage may vary) & (some re-assembly will be required).

Download & install the 4099.funlove virus and you won't fall in love nor have fun, however you will learn about subnet isolation.

In less then a blink of an eye your network clients are wiped out and you won't know it ...until.... it's tooooooooo late.

A good virus want's to propagate itself (in background) by seeding client's on the network, 510 or 255 is your choice...your config.

Hackers & Viruses EAT what YOU feed them....like Bear's.

So don't feed the Bear's..!!!

192.168.1.1:8080/server-manager

***** Why is that on 8080..??????

192.168.1.1/server-manager  #Should just work.
Primary domain/server-manager  #Should just work.

Both are port 80 to start, SME will redirect 80 to ssh from there (SME default).

Is your ISP blocking 80 and/or your trying to spoof it..????

I must me missing a step or not understanding something.

Possibly...however I see in my crystal ball (50 mile range limit) that you will see great networking joy in the near future..!!

Follow the yellow brick road...!!

hum...interesting....

HTH

Have a good day....

[electroman00]

At this point I would try another router, perhaps an appliance such as a consumer-grade Linksys or D-Link, to see if the problem is with  SME's port forwarding or the target's Apache or TCP/IP setup.

I think it's more of a case of "Faulty Operator".

There's clear road signs to that possibility.

I think once you get it all working, you'll be patting your self on the back and kicking yourself at the same time.

So... just hang in there and forge on.... your almost there...!!

Forget brick router and (Apache)... listen to Charlie....  "The Great OZ".

You will pay dearly for not listing to Charlie.

Surprised you haven't learned that lesson already.

Have you every heard the line

I told you so...

Try this one

"The Great OZ has spoken"

Ring any bells

[midnightferret]

Thank you all for your input.

I have been listening to CharlieBrady's posts. He said that I should be able to simply forward port 80 to the webserver machine. He told me to UNDO the virtual host.

There is nothing ahead of SME, except a cable modem. Besides, it seems to be working now, thanks to Charlie. And I didn't do anything except follow his instructions.

The port forwarding now works for anyone who isn't inside my lan. I can get to the server-manager by going to my server's IP address. This is perfectly fine for me. Thanks.