1

I'm experiencing a major head-ache at the moment with our company firewall, we're currently changing ISPs (new lease line and new block of static IPs) and I'm setting up firewall rules (we're using a NETGEAR ProSafe VPN Firewall FVX538).

The firewall is visible internally on 1.1.1.2 (all IPs for example only) and we can configure it through the web admin on ports 80 and 443. All traffic from our building goes out on 123.123.123.102, but when you go to the 123.123.123.102 IP (from within or outside the network), the firewall admin page is shown. This isn't really what we want!

I've tried adding firewall rules for HTTP traffic on 123.123.123.102 to be routed to one of our web servers at 1.1.1.9, but when I add this rule, requests to 123.123.123.102 just hang. If I change my rule to 123.123.123.103, it works fine but the NETGEAR admin's still visible on 123.123.123.102 - problem not solved.

The real problem is that this means we can't point our domain example.com to 123.123.123.102, because the NETGEAR admin would show rather than our site, but we need this domain to resolve to 123.123.123.102 because all mail out of our building will come from this IP (our client's spam filters won't let our mail through - reverse DNS problems).

I'm banging my head against my desk: this MUST be possible, or how would a company that has a single IP address be able to resolve web traffic? Can anyone help? Sorry if the questions doesn't make a lot of sense - I always find questions like this difficult to express!

Update / Things I've tried

  • Ensure remote management is disabled (it's never been enabled anyway) screen
  • Rebooted firewall
  • Checked for firmware updates
  • Tried adding DMZ WAN rule in place of a LAN WAN rule

3 Answers 3

1

Turn off remote management or move it to a different port. Beat it over the head then offer it chocolate. Repeat cycle until it actually turns off remote management. Then complain to your vendor about the buggy firmware.

Edit, new answer: Remove all special "forwarding" style rules and put 1.1.1.9 in a DMZ zone so that all outside calls get routed to it instead.

Edit, right answer: Connect to the right device. (see comments)

14
  • Hi, thanks for the answer but remote management is completely off.
    – Rowan
    Apr 15, 2011 at 9:32
  • @Rowan: Huh. Well that' dumb. It sounds like it's ignoring you. Please tell me you rebooted it :) See my edited answer for another idea.
    – Caleb
    Apr 15, 2011 at 9:44
  • 1
    Ballsy balls! OK, we have two firewalls running in parallel, the new one on 1.1.1.2 and the old one on 1.1.1.3. When we changed 1.1.1.9 to my machine's IP (1.1.1.199) it just worked! Then we realised that 1.1.1.9 is connected to the internetz via 1.1.1.3, but my machine's connected via 1.1.1.2, doh! moving my machine to use 1.1.1.3 causes the same hanging behaviour... I feel like such a noob!
    – Rowan
    Apr 15, 2011 at 11:17
  • 1
    Um. Ya. So forwarding to a device inside the network that is talking to the outside world via a different router will definitively screw up your network!
    – Caleb
    Apr 15, 2011 at 11:25
  • 1
    Thanks for being my Rubber Duck! I think you probably contributed most, although the real answer is: "Rowan, you shouldn't be configuring a firewall, stick to the websites..."
    – Rowan
    Apr 15, 2011 at 11:25
1

There's 2 reasons why the router admin page would show up on port 80.

  • you connected the WAN (your ISP's connection) to a LAN port (probably unlikely since you would have had to set the public IP on the LAN interface)
  • the remote management port is set to port 80 (check under Administration -> Remote Management)
10
  • Point one may be the issue, point two I've already tried - remote management is completely disabled! As you may have guessed, I'm not really a 'server admin', I've been tasked with this because 'web developer' is the closest we've got... Could you explain point one a little more? I'm not 100% sure how I'd actually go about checking/solving that.. Thanks :)
    – Rowan
    Apr 15, 2011 at 9:24
  • Well first of all check where the WAN cable (the one from the ISP's device) is plugged in to. As far as I can see it should be plugged into one of the WAN ports on the left side. Can you check that?
    – iserko
    Apr 15, 2011 at 9:27
  • Yep, that's plugged into WAN1 so not a problem
    – Rowan
    Apr 15, 2011 at 9:32
  • OK, that means that your Internet connection is good. You can access the internet through it normally, right?
    – iserko
    Apr 15, 2011 at 9:34
  • Yep, there's no problem connecting to the internet at all
    – Rowan
    Apr 15, 2011 at 9:34
1

It sounds as if the firewall's firmware is buggy. Have you checked to see whether you're running the latest version of the firmware?

You may want to try enabling remote management, restricting the access to some bogus IP address (127.0.0.1 should do just fine), and changing the port number. At that point, it may be possible to install the inbound forwarding rules you want.

Note that you can have reverse DNS entries that point 123.123.123.102 to example.com so that your mail works, while still having forward DNS entries that point example.com and www.example.com somewhere else...but I would endeavor to avoid this situation if possible.

2
  • Firmware is completely up-to-date, I'll try setting remote management with a bogus IP temporarily
    – Rowan
    Apr 15, 2011 at 10:32
  • That had no effect I'm afraid :(
    – Rowan
    Apr 15, 2011 at 10:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .