0

So the scenario is the following i have a router when a request goes directly to its public address X.X.X.X it port forward to a IIS server, nevertheless my IIS has as its gateway a iptable/squid server which i have allowed the IIS the privileges to pass by this services with a rule of forwarding all IIS and setting it as a fullAccessUser on Squid.

Even though it always promt 110 connection time out and i don't know why, because it should be able to go out. The scenario is something like this one:

enter image description here

Improve this question

1 Answer 1

Reset to default
1

You are doing something called "asymmetrical routing", and it has potential pitfalls when used in conjunction with NAT and stateful firewalls. Specifically, I believe by trying to send the return traffic through the iptables/squid machine, it will be blocked every time. It is the equivalent of asking the squid server to join in a conversation 1/2 way through and know instantly what's going on.

The fix is simple: don't bypass the squid proxy for the inbound traffic. Configure your router to port-forward 80 to the squid server, and then setup squid to act as a reverse proxy for your IIS server. Then all traffic will be internet -> router -> squid -> IIS and then IIS -> squid -> router -> internet. Alternatively, you can port-foward to the squid server, and then port-forward again to the IIS server. I recommend against doing that though.

Further reading:

http://wiki.squid-cache.org/SquidFaq/ReverseProxy http://www.cisco.com/web/services/news/ts_newsletter/tech/chalktalk/archives/200903.html

Improve this answer
2
  • what happen if need that for other ports aswell? like remote control port should i do that with iptable?
    – Necronet
    May 10, 2011 at 16:52
  • Squid doesn't "speak" RDP (I assume that's what you mean by "remote control"). So yes, use iptables to do the port forwarding.
    – David Bishop
    May 12, 2011 at 4:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .