1

I'm fairly sure this is either a NAT or routing question, but it's one that continually has me stumped.

The hardware is a Checkpoint Safe@Office firewall. The default mode of operation is that wired clients are on a 192.168.10.x network and wifi clients are on a 192.168.252.x, and that they are firewalled from each other.

One computer on the wired side is acting as a web server; serving the 'dev' subdomain of my business website. It is accessible from outside and inside and all works fine.

I however have a need for the wired and wifi networks to be able to talk to each other for other reasons. To do this; you can set the device into 'bridge mode' whereby both wired and wifi clients all end up with a 192.168.10.x IP address and can communicate freely.

Unfortunately, something about bridging in this way then seriously hampers the performance of the web server to the point where it's unusable from inside of the network - its still fine externally.

If I ping dev.mydomain.com from inside the network, it resolves to my public IP - and all my prior attempts (and googling) to get this configuration working suggests that because the request is outbound, then coming back into the network, it's "double natting" or something similar, causing the router to not be sure what to do with it.

Is there a way to solve this? I've found other people with the same problems (across different devices too) but haven't seen a solution that works.

Updated 31/03/2013:

I'm fairly convinced that the first answerer is on the right track with redirecting traffic using NAT rules.

At first, I thought the hardware wasn't working - but i've been able to confirm it by successfully redirecting all outbound web traffic from one device to nothingness, at it worked as expected.

So now the question is - what NAT rule(s) need to come into play to ensure traffic is property routed to the internal network?

I've attempted what seemed the most obvious:

WHEN: Source is Internal Networks, Destination is My Public IP and service is Web Server

THEN: Don't change the source, Change the Destination to My Internal Server IP and don't change the service.

This doesn't work, but I feel as though it should.

Update #2

I'm using the Microsoft Network Monitor to try and watch the packets of data to see if that offers up any insight.

Firstly, this raises a question about how the NAT translation works - because even with the rules in place, I see the request going out to dev.mydomain.com and inside the packet, the destination still reads as my public IP. Should translation actually CHANGE the destination, or is it just that it should silently redirect it?

Secondly, this also confirms the problem. If I look at a real website whilst capturing packets, the pattern looks pretty much as you would expect - firstly, a DNS lookup goes out and comes back, followed by a number of requests (presumably pertaining to all the standard files, JS, CSS etc as well as the HTML itself) each of which are almost immediately answered with packets of data.

If I look at my dev. subdomain; it's very one sided. With or without NAT rules, what I am seeing is that the request goes out and the initial responses come back, then the HTTP GET request goes out and is returned (and actually contains the HTML for the page) - but then nothing else. A bunch of requests go out for (I presume) the includes, and they are not answered. Eventually, they go out again, but still nothing comes back.

Could we be looking at an Apache problem rather than a router problem?

Update #3

So I created a basic HTML page with just a line of text and no included files and it works with or without NAT rules, sometimes instantly, sometimes it takes a few seconds - but it always works. I then included an image in the same way as they are included in the real pages, and it loaded - but always took between a few and tens of seconds to do it. Given that a real page will have a number of image requests as well as other files, it doesn't seem surprising that if they are all that slow, then this explains why the page times out. I'm no closer to figuring out why.

Codecraft
  • 283
  • 2
  • 5
  • 15

1 Answers1

1

You should be able to setup a Transparent Proxy rule in this device to redirect all outbound traffic from the internal network bound for port 80 to your external IP address to be redirected to your webserver's local (internal) IP address.

Under NAT:

Source: Internal Network IPs (Range) 192.168.10.1-192.168.10.254
Destination: External IP
Service: Web Port 80

Change the destination to:
Destination: Internal WebServer IP

At present you're performing an external DNS lookup and DynamicDNS is providing the external IP of your network for the dev server. The internal traffic tries to go out of the router and then the router's supposed to perform the NAT back to the local (internal) IP of the webserver for port 80 traffic from the web.

In the sake of security you should probably only allow traffic on the webserver from your specific (whitelisted) IP addresses (internal and external) since you're allowing connections from outside.

AbsoluteƵERØ
  • 146
  • 8
  • I understand that the problem is the traffic leaving the network when it should simply resolve to the internal IP, but I don't know how I can reconfigure the gateway to do that. – Codecraft Mar 30 '13 at 19:56
  • It's around page 420 in the safe@office manual (under using NAT rules). – AbsoluteƵERØ Mar 30 '13 at 20:02
  • Not in the old copy of the manual I have, but an online version has a section on setting up NAT rules around 440. The problem is that I know HOW to set up a NAT rule, I just don't know WHAT rule to set up. – Codecraft Mar 30 '13 at 20:11
  • Here you go. Sorry about that. https://downloads.checkpoint.com/fileserver/SOURCE/direct/ID/12141/FILE/CheckPointSafe@OfficeUserGuideV82.pdf – AbsoluteƵERØ Mar 30 '13 at 20:16
  • This only tells you how to set up NAT rules, which I understand. What I don't understand is the specifics of the rule(s) I need. Trying a few that I think should do the trick results in basically no difference. – Codecraft Mar 30 '13 at 20:26
  • I had it written out in the paragraph above, just spelled it out in the highlight. – AbsoluteƵERØ Mar 30 '13 at 20:28
  • Sorry, I missed that. Anyway, you would absolutely think that would work wouldn't you? I've tried a number of different ways of adding that rule but there is absolutely zero difference with any of them. I even tried a rule to translate my external hosting server to Google's IP just as an obvious test - assuming that's something that's possible, that had no effect either. – Codecraft Mar 30 '13 at 20:40