0

I have a rent server running XenServer 6.2 I only have 1 public IP so i did some NAT to redirect ports 22 and 80 to my WebServer VM. I have a problem with the port 80 redirection.

When i use this redirection, i can get in the WebServer's Apache but this server lose Web access.

I get this kind of error :

W: Failed to fetch http://http.debian.net/debian/dists/wheezy/main/source/Sources  404  Not Found [IP: 46.4.205.44 80]

but i can ping anywhere.

XenserverIP:80 redirected to 10.0.0.2:80 (WebServer).

This is the port 80 redirection part of my XenServer iptables :

-A PREROUTING -i xenbr1 -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.0
.2:80

-A INPUT -i xenbr1 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
COMMIT

What is wrong in my configuration? Is there a problem with XenServer?

Thanks for your help !

Edit : Here is my iptables full content :

*nat
:PREROUTING ACCEPT [51:4060]
:POSTROUTING ACCEPT [9:588]
:OUTPUT ACCEPT [9:588]
-A PREROUTING -p tcp -m tcp --dport 1234 -j DNAT --to-destination 10.0.0.2:22
-A PREROUTING -i xenbr1 -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.0
.2:80
-A POSTROUTING -s 10.0.0.0/255.255.255.0 -j MASQUERADE
COMMIT
*filter
:INPUT ACCEPT [5434:4284996]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [5014:6004729]
-A INPUT -i xenbr1 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
COMMIT

Update :

I have a second server with 10.0.0.3 as IP and it has the same problem that 10.0.0.2 has.

I think i found a little bit of an explain :

I have apache which listen on 10.0.0.2:80 Since i have NAT forwarding rule on my Xenserver, all incoming traffic from external network (website requests, downloads...) is routed to 10.0.0.2:80 because it uses port 80.

That is why i have the same problem on my 2nd VM. If i try to do an apt-get update, i make request to websites which return to port 80 therefore is routed to apache.

Anybody can help me solve this issue? (It's problematic i can't access websites on my internal LAN if my Apache Server is running ^^)

1
  • Nobody can help me? :(
    – Lain92
    Jun 9, 2014 at 2:22

1 Answer 1

0

Your DNAT rule should include "-d your-public-external-ip", otherwise the NAT rule will match all packets to port 80, including outgoing packets. You're probably redirecting outgoing HTTP requests to your own webserver. Looking at the accesslogs should confirm this.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .