0

So the scenario is the following i have a router when a request goes directly to its public address X.X.X.X it port forward to a IIS server, nevertheless my IIS has as its gateway a iptable/squid server which i have allowed the IIS the privileges to pass by this services with a rule of forwarding all IIS and setting it as a fullAccessUser on Squid.

Even though it always promt 110 connection time out and i don't know why, because it should be able to go out. The scenario is something like this one:

enter image description here

Improve this question

1 Answer 1

Reset to default
1

You are doing something called "asymmetrical routing", and it has potential pitfalls when used in conjunction with NAT and stateful firewalls. Specifically, I believe by trying to send the return traffic through the iptables/squid machine, it will be blocked every time. It is the equivalent of asking the squid server to join in a conversation 1/2 way through and know instantly what's going on.

The fix is simple: don't bypass the squid proxy for the inbound traffic. Configure your router to port-forward 80 to the squid server, and then setup squid to act as a reverse proxy for your IIS server. Then all traffic will be internet -> router -> squid -> IIS and then IIS -> squid -> router -> internet. Alternatively, you can port-foward to the squid server, and then port-forward again to the IIS server. I recommend against doing that though.

Further reading:

http://wiki.squid-cache.org/SquidFaq/ReverseProxy http://www.cisco.com/web/services/news/ts_newsletter/tech/chalktalk/archives/200903.html

Improve this answer
2
  • what happen if need that for other ports aswell? like remote control port should i do that with iptable?
    – Necronet
    May 10, 2011 at 16:52
  • Squid doesn't "speak" RDP (I assume that's what you mean by "remote control"). So yes, use iptables to do the port forwarding.
    – David Bishop
    May 12, 2011 at 4:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.