Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So the scenario is the following i have a router when a request goes directly to its public address X.X.X.X it port forward to a IIS server, nevertheless my IIS has as its gateway a iptable/squid server which i have allowed the IIS the privileges to pass by this services with a rule of forwarding all IIS and setting it as a fullAccessUser on Squid.

Even though it always promt 110 connection time out and i don't know why, because it should be able to go out. The scenario is something like this one:

enter image description here

share|improve this question

1 Answer 1

up vote 1 down vote accepted

You are doing something called "asymmetrical routing", and it has potential pitfalls when used in conjunction with NAT and stateful firewalls. Specifically, I believe by trying to send the return traffic through the iptables/squid machine, it will be blocked every time. It is the equivalent of asking the squid server to join in a conversation 1/2 way through and know instantly what's going on.

The fix is simple: don't bypass the squid proxy for the inbound traffic. Configure your router to port-forward 80 to the squid server, and then setup squid to act as a reverse proxy for your IIS server. Then all traffic will be internet -> router -> squid -> IIS and then IIS -> squid -> router -> internet. Alternatively, you can port-foward to the squid server, and then port-forward again to the IIS server. I recommend against doing that though.

Further reading:

http://wiki.squid-cache.org/SquidFaq/ReverseProxy http://www.cisco.com/web/services/news/ts_newsletter/tech/chalktalk/archives/200903.html

share|improve this answer
    
what happen if need that for other ports aswell? like remote control port should i do that with iptable? –  Necronet May 10 '11 at 16:52
    
Squid doesn't "speak" RDP (I assume that's what you mean by "remote control"). So yes, use iptables to do the port forwarding. –  David Bishop May 12 '11 at 4:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.