1

My company uses subversion (with the svn protocol on port 3690, not over http) with a local server on our intranet. Currently our developers have their SVN clients pointed to the local IP address of the server (192.168...). We are trying to open up access to the SVN server from the internet, so that developers away from the office can access the subversion services. We have a static IP address, and set our firewall and router to allow traffic on port 3690 and to forward to the correct computer. From outside the office, we can successfully connect to the server using svn://98.<...>:3690. Things are almost good.

Our problem:

Computers that are IN the office cannot access the subversion server using the public IP address; the connection just times out. When we ping our public IP address from inside the network, the response time is 1ms, and 'tracert' shows that the connection is getting only as far as the router before coming back. Attempting to telnet to our external IP address from outside the office shows a connection, but from inside the network we get nothing. Our firewall is not restricting outgoing traffic at all.

Can anyone help us out?

Improve this question

3 Answers 3

Reset to default
3

This is not an SVN problem, but rather a firewall feature. Knowing the firewall model would be nice here.

In any case, you should not and often cannot (in the case of Cisco PIX/ASA specifically, without major configuration tweaking) hit the outside IP of your firewall from the inside. Instead, you should configure DNS so that the same name (svn.yourcompany.com) would resolve to the outside IP for external clients and to the 192.168.x.x IP for internal clients. This can be done by using different DNS servers for outside and inside, or same DNS server with multiple views, or using DNS rewrite capabilities of your firewall. Please leave a comment with the firewall model and the description of your DNS setup, and I'll be able to be more specific.

Improve this answer
1
  • This is called a Split DNS Infrastructure and is what I would recommend as well. I actually do this with my own SVN server.
    – Christopher
    Oct 6, 2009 at 15:36
0

You can't send data out the router that is destined for inside the router. The public IP will not work inside the LAN. Try setting up a /etc/hosts file with the SVN server hostname = the public or private IP depending on the location of the client computer. Then access the SVN server via hostname.

Improve this answer
2
  • /etc/hosts would be maintenance hell for mobile users.
    – Max Alginin
    Oct 6, 2009 at 13:47
  • I agree. If you can configure your internal DNS then you could accomplish the same thing with less overhead. I don't have that kind of access at work.
    – Chris Nava
    Oct 6, 2009 at 16:23
0

Depending on your firewall, you will need to configure it to allow traffic from your internal network to the external IP, aswell as the required routing.

It's doable in "real" firewalls, but probably not in cheaper "routers".

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .