Help - Unable to reach host on the LAN using FQDN



  • Re: Help with making LAN behave same as WAN

    @Derelict Could you please share the details of the port forward? I am trying to replicate a similar HAproxy setup but I am failing miserably.

    I can reach the host via WAN, but on the LAN side I am unable to open the website.

    Thanks in advance.


  • LAYER 8 Netgate

    I have Split DNS configured so outside requests get the WAN address and inside requests get the localhost VIP 192.168.225.1.

    I created a localhost VIP on 192.168.225.1/32

    That is what I bind to as the listen address in the HAproxy frontend.

    Connections on WAN to WAN_IP:443 get forwarded to 192.168.225.1:443
    Connections on WAN to WAN_IP:80 get forwarded to 192.168.225.1:80

    Connections from the inside to 192.168.225.1 "just work"

    The backend servers are in a DMZ.



  • OK. My fault, I should have been clearer. I had managed to connect to both WAN and LAN IP with a similar setup as yours.. but then I noticed that I could not get to non HTTP/HTTPS ports while on the LAN (cause I had to point the DNS record to the VIP).

    Example:

    LAN IP: 10.0.1.5
    VIP: 10.10.10.10

    To have such setup working I must create a Host Override like so: my.host.com 10.10.10.10

    Because my.host.com is pointing to 10.10.10.10 this happens:
    From WAN: HTTP/HTTPS to my.host.com is working fine though HAproxy - SSH not exposed (by design)
    From LAN: HTTP/HTTPS to my.host.com is working fine through HAproxy - SSH to my.host.com will not work cause of the host override....

    I know, I could:

    a) SSH into 10.0.1.5
    b) create a host override for ssh.my.host.com 10.0.1.5

    but.... I want to find a a solution where I can forward SSH on the LAN to the hostname my.host.com (10.10.1.5).

    Do you think there is an elegant solution to this?


  • LAYER 8 Netgate

    I connect to the backend servers directly.

    I refuse to rely on NAT reflection or crap like that on my network.


Log in to reply