Help - Unable to reach host on the LAN using FQDN
-
Re: Help with making LAN behave same as WAN
@Derelict Could you please share the details of the port forward? I am trying to replicate a similar HAproxy setup but I am failing miserably.
I can reach the host via WAN, but on the LAN side I am unable to open the website.
Thanks in advance.
-
I have Split DNS configured so outside requests get the WAN address and inside requests get the localhost VIP 192.168.225.1.
I created a localhost VIP on 192.168.225.1/32
That is what I bind to as the listen address in the HAproxy frontend.
Connections on WAN to WAN_IP:443 get forwarded to 192.168.225.1:443
Connections on WAN to WAN_IP:80 get forwarded to 192.168.225.1:80Connections from the inside to 192.168.225.1 "just work"
The backend servers are in a DMZ.
-
OK. My fault, I should have been clearer. I had managed to connect to both WAN and LAN IP with a similar setup as yours.. but then I noticed that I could not get to non HTTP/HTTPS ports while on the LAN (cause I had to point the DNS record to the VIP).
Example:
LAN IP: 10.0.1.5
VIP: 10.10.10.10To have such setup working I must create a Host Override like so: my.host.com 10.10.10.10
Because my.host.com is pointing to 10.10.10.10 this happens:
From WAN: HTTP/HTTPS to my.host.com is working fine though HAproxy - SSH not exposed (by design)
From LAN: HTTP/HTTPS to my.host.com is working fine through HAproxy - SSH to my.host.com will not work cause of the host override....I know, I could:
a) SSH into 10.0.1.5
b) create a host override for ssh.my.host.com 10.0.1.5but.... I want to find a a solution where I can forward SSH on the LAN to the hostname my.host.com (10.10.1.5).
Do you think there is an elegant solution to this?
-
I connect to the backend servers directly.
I refuse to rely on NAT reflection or crap like that on my network.
