|
[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]
|
Re: [PLUG] Apache server not serving...
|
Definitely a firewall/network design issue.
A few things... How does a 10.X machine talk to 192.X machine? My guess is
it goes through the firewall, sounds like your firewall has two internal
nets (a 10.X int and a 192.X dmz).
So the 10.X machines sends a packet through the firewall to the apache
box. Problem is, the apache box is multi-homed to the 10.X network. The
packets will not return to the sender by way of the firewall, instead, it
will just use broadcast info on that second 10.X NIC and return that way.
Packets have to return the same way they came in. Now I cant explain why
it works some of the time, but regardless, something screwy is going on.
Your setup is common, and commonly has issues. My question is: If you are
on a 10.X machine, why would you want to talk to apache on the 192.X? And
if you did want to talk to apache on the 192.X, then why did you
multi-home the apache server in the first place?
When you start playing around with firewalls, and multiple nets, you can
get lost when trying to do too much. Either run the apache box as a true
dmz machine with only a 192 nic, or if you do multi-home it, only talk to
it via the 10.X address from inside your corp network. You cant "easily"
do both...
-John
On Wed, 10 May 2006, George Gallen wrote:
> This has been bugging me for a couple years now...
>
> I have a Redhat server (7.2) that has two NICS (eth0=10.10.) address, the other is a (eth1=192.168).
> call eth0 site1.domain.com and eth1 site2.domain.com
> Our corp network passes an internet IP through a firewall => 192.168 address
> Our internal corp network has the 10.10 addressing.
>
> Apache (1.3.27)
>
> The server works perfectly on the 10.10. Any requests to site1.domain.com work as expected, the
> HTML code is returned, all .cgi's work, and all images are sent.
>
> When one tries to access the system using the 192.168 side, Any requests to site2.domain.com
> will return the HTML code as expected, and run the .cgi's as expected, however, I never
> get any of the images.
>
> Now, the strange part. If you look at the access logs, it shows the images as being sent?
> with the correct time and file size.
>
> I've been assured by our IIT staff that the firewall could not be possibly blocking them.
>
> There are no errors logged anywhere. Can anyone think of anything to check into?
>
> Generally this hasn't been an issue because all of web stuff that needed to be done externally,
> did not require images, just the html/cgi pages. But now I'm working on a project with images.
>
> I will have to setup a tcpdump on the eth1 tonight to monitor output to see what is actually being sent.
>
> Yes, I know the OS is old...that won't change, and the Apache is old, but the problem has existed
> on older versions of apache as well, I don't think upgrading will solve this issue.
>
>
> George Gallen
> Senior Programmer/Analyst
> Accounting/Data Division
> ggallen@slackinc.com
> ph:856.848.1000 Ext 220
>
> SLACK Incorporated - Delivering the best in health care information and education worldwide.
> http://www.slackinc.com
>
>
>
___________________________________________________________________________
Philadelphia Linux Users Group -- http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion -- http://lists.phillylinux.org/mailman/listinfo/plug
|
|