1

This problem has only started to happen over the past few days, and nothing has changed (that I am aware of) so struggling to see what has happened.

I have a network setup that all run off the same router. One of the machines on that network is used to host websites which runs Microsoft Exchange Server 2003 & IIS 6.0. I have domain names which I have purchased from various hosting companies and I have updated the DNS records at their end to point to my web server i.e. I have setup an A record to point to my web server IP.

Everything was working fine up until a couple days ago - now I can't access any of my sites via IP or domain name from any machine on the network! Can still get access publically & also if I am connected to the network via VPN I can access the sites. As far as I am aware no Firewall rules have been changed & no router configuration has been changed so this is really odd.

If I add the internal IP & domain name into the Hosts file on the server I can get access, however, this doesn't work for the sub domains....

Any idea's what this could be?

6
  • Does nslookup on "their end" deliver the expected results?
    – Nils
    Nov 9, 2011 at 20:37
  • @Nils Define "their end"? If I do an nslookup on the domain in question I get the same results regardless if I am off the domain or on it.
    – James
    Nov 9, 2011 at 20:40
  • "Their end" is your wording when you wrote about the DNS-changes. So I assume you have local DNS-servers at these hosting companies. Please explain your term "on the network" - are your webservers multi-homed, with one leg in the internet and one on an internal network of the provider?
    – Nils
    Nov 9, 2011 at 20:47
  • Ah ok I see. What I meant really was I purchased a domain name and by doing so they give you access to the DNS configuration. So basically what I was referring to was simply logging in through their web control panel and updating the DNS config. "On the network" - I have one machine which is the web server and a few others which are just "user" machines for in the office.
    – James
    Nov 9, 2011 at 20:54
  • Ok - so you did not change anything and we are talking about a windows (w2k8r2?) webserver. Did you check the (automatically) installed Microsoft patches? Some of those can have nasty side-effects.
    – Nils
    Nov 10, 2011 at 21:25

1 Answer 1

2

Given that you already said nothing changed with your firewall and router, I doubt this is the case, but I felt compelled to comment. On some routers/firewalls, when you nat a (web)server, the inside IPs have trouble accessing the webserver using the external IP. Basically the firewall isn't smart enough or is missing the nat/routing rules to loopback to itself.

For our Sonicwalls, you can add a nat rule that basically says if its coming from the internal network going to the external IP, nat it to the internal IP. Not all firewalls let you do this though. I can elaborate more on this if you wish.

If this is indeed what is causing your problem, you need to add a hairpin NAT rule. A hairpin NAT rule allows a network request originating from an internal host to leave the network and then come back into the router on the WAN port and the request will be properly translated from the public IP of the router to the internal IP of your web server. The process for doing this is different depending on the make and model of your router. If you would provide that information it will help us.

A simpler fix is if you have an internal DNS server, add the A records there for the domain and subdomains pointing to the internal IP.

4
  • Yeah I read a few articles which mentioned that about the firewall blocking it because it's the same IP - One solution to that was to add the domain/IP mapping into the hosts file (which subsequently worked). However, what I am failing to understand is why has this all of a sudden started happening. Is it normal for this sort of thing to just happen? i.e. is it possible the router is playing up? I thought a good starting point would be to determine what causes this problem which is why I posted.
    – James
    Nov 10, 2011 at 11:28
  • Yeah, I am not sure why it would happen all of a sudden. My only thoughts would point to the firewall and/or router.
    – MikeAWood
    Nov 17, 2011 at 3:48
  • There is definitely an internal DNS setup, however, would this mean I would just need to it up the same way I have on my Domain Name host provider?
    – James
    Nov 17, 2011 at 9:54
  • On your internal DNS server you would create your zone (external domain name) and create the A records and PTR records however, the IP addresses you set will be the private IP addresses of the servers on your network. So when an internal client makes a LAN request for the server by public FQDN the DNS server says, oh you need the internal IP address and the request never exits your router. Feb 5, 2016 at 18:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .