External DNS connections

[HodgeHi]

Hello. I hope everyone is well,

 

I have posted before about looking to host our own services. Since then i have registered with nominet and have spoken to broadband sandwell that look after the boroughs systems.

 

They have said i can take control of the services if i want to until we move over to the broadband sandwell network in 2009.

 

I have looked at adding our nameserver into the nominet list but am now feeling a bit confused.

 

The confusing part is this.

 

I have added our servername (one holding mail) as the ns.domainname.com and have added the external gateway address to the name server. Is this correct?

 

I have also been looking at sheilds up! and have seen that it scans a 202.x.x.x address which would be our external RM cache. All ports are stealthed.

 

Is this going to cause me problems?

 

I have a internal proxy with a firewall (schoolguardian) and also firewalls on the OS X servers themselves. I tried doing a lookup on the ns.domainname.com but came back with no details.

 

Am i going about this the wrong way? First time setting up external connections with domain registrars. Closest i have come is dydns at home which seems to work fine.

 

I also do not yet know if this IP address we are given on the external side is static.

 

Could anybody shed some light on the best steps to take.

Thanks.

[Jona]

Hi there,

I can't quite understand all of your post so forgive me if this isn't helpful...

 

Seems like you need to start from base principles, e.g. First get your external IP successfully connected to your internal router / gateway (should just be a matter of entering it once it's been allocated).

 

Then setup the link from your router to the server inside your DMZ (should just be a direct mapping assuimg your not NAT'ing for any reason..).

 

Once this is done prove to yourself that would can navigate to the services you want on your server (web, email, etc) from outside your school network using an IP address.

 

Once you've sorted that out you should be able to look at doing DNS to nicely map your domain name to that IP.

[greenfieldsupport]

Hello. I hope everyone is well,

 

I have posted before about looking to host our own services. Since then i have registered with nominet and have spoken to broadband sandwell that look after the boroughs systems.

 

They have said i can take control of the services if i want to until we move over to the broadband sandwell network in 2009.

 

I have looked at adding our nameserver into the nominet list but am now feeling a bit confused.

 

The confusing part is this.

 

I have added our servername (one holding mail) as the ns.domainname.com and have added the external gateway address to the name server. Is this correct?

 

I have also been looking at sheilds up! and have seen that it scans a 202.x.x.x address which would be our external RM cache. All ports are stealthed.

 

Is this going to cause me problems?

 

I have a internal proxy with a firewall (schoolguardian) and also firewalls on the OS X servers themselves. I tried doing a lookup on the ns.domainname.com but came back with no details.

 

Am i going about this the wrong way? First time setting up external connections with domain registrars. Closest i have come is dydns at home which seems to work fine.

 

I also do not yet know if this IP address we are given on the external side is static.

 

Could anybody shed some light on the best steps to take.

Thanks.

 

Okay Please tell me what it is your trying to "host yourselves"?

for Most services, you dont need your own nameserver (dns) server to be visiable on the internet, most people use the nameservers provided free by the place you bought the domain name from.

 

If for example you wanted to host a webserver... you would set up your webserver, make sure it works locally, then you would log into your router (the default gateway on the internet machine) and you would Forward the required port, in this case, as a webserver defaults to port 80 and you havent changed it, you would forward port 80.

 

The default gateway / router would ask you also for the local ip address of the machine you want to forward port 80 to, so you would put this in also, something like 10.0.2.12 or 192.168.1.7

 

THEN you would configure DNS, both internally and externally, firstly you would log into the webpage you bought the domain from, and you would add a record into the dns for domainname.com OR http://www.domainname.com

 

(the www as that is what you are serving, if you wanted an ftp server you should use ftp.domainname.com but it can infact be anything : somethingtotallyrandom.domainname.com)

 

you would add the REMOTE ip address of your router to this, this should be the 202.*.*.* one you talked about

 

then you would save, log out, wait 12 hours and try it from home, and it should work

 

now if you want to be able to type http://www.domainname.com INSIDE of work, you would have to also create records in your local DNS server.

 

 

 

I hope this helps somewhat but im not entirely sure i understand your question.??

[HodgeHi]

OK let me try to clarify.

 

I will start from internal to external

 

We have 4 servers. 2 AD and 2 OD. AD servers host the active directory but more importantly the DNS for internal network.

 

The 1 OD server hosts the Web site and the Mail service.

 

These point to a School guardian proxy which is also the gateway for the clients.

 

On the external connection from the School Guardian proxy box (which also is a firewall) is a second router a BT one). This is the actual gateway to the internet.

 

On the external side of the BT router is the RM proxy.

 

Our school guardian proxy upstreams to the parent proxy to work.

and the servers can bypass the school guardian to get to the rm one.

 

I have set up the switches so that the clients cannot connect directly to the BT router so have to go through the School guardian.

 

The gateway was set up like this when i arrived (apart from the local proxy box).

 

I tried a port scan from an external site on the BT router which is in the 194.x.x.x range but the IP it cam back with was in the 202.x.x.x range which must be the RM cache box.

 

The confusion i have is which IP do i point it at? the RM one or the BT Router one. I at first thought it must be the BT one since i need it to see that and forward the requests to the school guardian which would forward the requests to the correct server. But after the scan i was not sure since the ports all came back stealthed and not responding to anything with either a deny or accept.

 

We are trying to host our own mail service and web site service so as we can gain more control internally for staff.

 

The domain name registered with nominet is the school one which points to broadband sandwell's servers. The nameserver is what nominet call the server you want your domain name to point to i think, although the servers already listed did not give any IPs which i thought was strange. How would these work then?

 

I know i need to point the domain name at our server but with the amount of firewalls and proxies in the way it is clouding what i think i should do.

 

My setup should be made more straight forward i think (and i may just sort it out pretty soon ).

 

Thanks for the replies and any more that can be given to make things a little clearer.

[DMcCoy]

Unless you have control over your incoming firewall and ip allocations there is no point in hosting a dns server for the outside world to see. You will still have to get change requests authorised if its anything like the south east grid.

 

I simply had a lot of ports opened, dns entires added and additional ip addresses allocated in a single request.

 

As you seem to be using RM (one of the ifl's) then the answer to asking them if you can host your own dns server will simply be "no" (Although they may say yes, air bourne pigs spring to mind).

 

I still don't understand what you are trying to achieve by hosting your own dns. If you just want internal services then you simply do what I mentioned above, raise a change request to get an ip, dns alias for the ip and relevant port opened.

 

You will have to pay for an smtp feed too I should think, I believe segfl charge us £1500 a year (They really *really* don't want people to host their own direct smtp servers - it all has to go through the grids mx relays)

 

Oh, and as to what IP, it's whatever ip(s) you have allocated to your router, not the proxy one.

 

I have a firewall managing 8 the ip addresses for our site

Edited January 9, 2008 by DMcCoy

[SYNACK]

Your should be able to get your true external ip by connecting to your bt router and looking at the status. Depending on what tool you used it could very well be the 202.x.x.x one and will not be the 192.168.x.x one as this is a private address space for internal use only.

 

To host these services you will need to configure port forwarding (virtual servers) in your BT routers configuration that points any incoming traffic to port 80 (web) to your web servers internal ip address. This is assuming that there are not other firewalls in your way as above. I would not recommend hosting your own external DNS even if you can as you will not need it for the services that you want to share.

 

After you have found your external ip and set up port forwarding you should be able to access the services via the ip address externally to test them.

 

Once you have done this it will be a good idea to talk to whoever runs your domain name and ask them to add/edit the DNS records on their server to add a subdomain that points to your external ip address. This means that you will be able to just use http://www.yourschool.co.uk to get to your site rather than the ip.

Edited January 9, 2008 by SYNACK

[Jona]

The nameserver is what nominet call the server you want your domain name to point to i think, although the servers already listed did not give any IPs which i thought was strange. How would these work then?

 

This is incorrect a name server is effectivly the DNS server for your domain and whilst it does provide a round about link to the actual IP of your server it shouln't be a direct link unless you are hosting your own DNS (not reccomended).

 

I would image you would need to the IP address of your router rather than your RM proxy (as that preumably only handles outbound connections). But this should be able to be sorted by looking on your router / calling your upstream provider.

 

Cheers

Jona

[greenfieldsupport]

I'd recommend one step at a time,

get everything working with IP addresses, before you move onto dns, with the exception of your mail server, you'll still need to talk to your isp anyway as you need them to create your PTR records, so that all your sent mail doesn't just wind up in the spam bin with most places.

 

Get the website working first,

 

using ip addresses

 

EDIT > forward port 80 on your router (194.*.*.*) to the local ip addres

 

Remember u carnt use shields up to do a port scan, as your RM cache is a forced proxy and it will pick up your web request and relay the request to shields up, which will then say oh hi rm box, and scan your cache not your router...

 

hope this helps

Edited January 9, 2008 by greenfieldsupport

[Jona]

Yeh I'd also reccomend you go step by step from beginning. Sort your IP'S out first.

 

But make sure you have considered the security implications of having an external hole into your normal network.

[HodgeHi]

Thanks for all your responses.

 

I understand now what you were all getting at when saying "hosting your own DNS server". I just want to have the domain name pointing to our servers which seems to hosted by nominet.

 

I think i see what is happening now. The nominet servers have the schools domain name registered but points to broadband sandwell's server for resolution. I think i need to speak to both RM and Broadband Sandwell to get that to resolve but first as you say i need to sort out the IP address resolution first.

 

I need to speak to RM to open the ports if i understand you correctly? They give us our internet connection.

[greenfieldsupport]

if thats where the internet is *pushed down to* then it shouldnt be much of an ordeal, however if EVERYTHING runs thru a series of proxys after your RM cache.... you might not actually even be able to do what you want. because if your ISP has only bought a small amount of IP addressed to be stingy and uses NAT to let you connect out.... they wont want to give one of them IP address up to you...

 

see what RM say when you phone them up!

 

Good luck!

[HodgeHi]

So its been a busy day so far. Yesterday was port-forward hell for me. I had issues when at home as well

 

I checked the school website from home last night and it now seems to be resolving back to the external server (LEAs) as it should now be. BUt got into school today and could not access them from inside our school.

 

I spoke to RM and they said they would look into it.

 

They have just got back to me saying that "the issue being DNS replication on their servers."

 

I have just tried the site but still no go on the site from in school.

 

I have also sent in a request for the ports to be opened on our router.

 

 

I can then try to get the IP address working into our internal web server.

 

The home issue was port forwarding on a 11n extreme router. I have set up a forward rule for port 25 which works fine but a port forward of 80 does not. Has anyone had any issues with an extreme port forwards or lack of them?

[Jona]

The home issue was port forwarding on a 11n extreme router. I have set up a forward rule for port 25 which works fine but a port forward of 80 does not. Has anyone had any issues with an extreme port forwards or lack of them?

[/Quote]

 

Who is your home ISP? A lot of ISPs block port 80 to stop customers running web servers. Worth some googling and experimentation to try and confirm if this is the case before you go too much furthur...

[HodgeHi]

my ISP is Virgin Media.

 

I have hosted my own web server before. It was a nas drive with web service available. I configured a US Robotics to port forward to the nas drive fine. But this time with the extreme it isn't working like it should. I have tried to port forward to the nas drive and it failed. I also tried to port forward to my leopard server and it is still failing. I am going to try a factory reset now and see if it resolves the issue.

[HodgeHi]

Well i have sorted out the problem at home. It ended up being a permissions problem on the root folder for the web pages.

 

Chown -R www:www seem to resolve the problem.

 

I have also sent the fax to RM about opening the ports and have yet to receive a reply.

[tom_newton]

FWIW, any SmoothWall users playing with port-forwards should think about turning on "connection logging" for debug purposes. This is set up under Networking/Firewall/Port Forwards. Do NOT have this on for general use, as it creates gigs of data, but if you're having issues, you'll be able to check the firewall logs (use the drop down to select port forwards) and that will tell you if the traffic is arriving ok at the external interface, and what is happening to it.

 

Common gotchas (all products, no just SW):

1. Make sure the box you're forwarding to is set with the right default gw

2. Make sure that you are forwarding from the right IP, especially if you have >1 external IP.

[HodgeHi]

I read that the best way to port forward through two routers/firewalls is like so:

 

External public facing (202.x.x.x) > internal public facing (10.x.x.x) > internal network (172.x.x.x).

 

One of the smoothwall guys helped me to create the firewall rules on my school guardian as i was unsure as to the best way to set up the rules.

 

I don't like firewall configuration much.

[greenfieldsupport]

Hodgehi did you get your site working in your school??

 

the best way would be to goto your LOCAL DNS server,

 

and create a domain for your website

 

so if yoursite is called http://www.myschool.net

 

create a domain called myschool.net locally and tell your dns server that your dns server is authoritive for that domain.

 

then create an A record IN that domain for www

with the LOCAL server address of your webserver.

 

then give it 10 mins to replicate to your other dns servers, and go to a client and type "ping www.myschool.net"

 

it should resolve as your LOCAL server address if not then type nslookup http://www.myschool.net and post the info here

 

if it does, then it should work fine in internet explorer or firefox or iceweasle or safari etc etc

[HodgeHi]

Well it's been over a week now and i have heard nothing from RM as to whether they have actually opened the ports i requested or even if they are still working on the issue. It's ridiculous for it to take this long.

 

So today i have taken their router off-line and put our old BT Voyager one back on and tried to get it working. But i am still getting an issue with the port forwarding.

 

The router is a Voyager 2091.

 

I have disabled the IP Filter and set up port forwards for port 80, 443 and 25.

 

Ip of router = 196.x.x.x

ip of private side of router = 10.x.x.254

ip of public side of school guardian = 10.x.x.1

private side of school guardian = 172.x.x.254

ip of webserver = 172.x.x.1

 

 

so given the above ips this is how it goes: -

 

80 from all --> 10.x.x.1 Voyager)

80 from 10.x.x.254 --> 172.x.x.1

 

same for all other port numbers.

 

Connection gets refused.

 

According to the logs on the School Guardian its not even getting to that point since there are no entries for any ports forwarded, rejected, stealthed, nothing at all in any of them apart from "main".

 

There doesn't seem to be any log option on the Voyager router so cannot see what's happening at that point.

 

Anyone have any ideas what might be wrong??

 

PS i have taken onboard what folks have said and have been trying to connect via IP. DNS resolves internally for the http://www.cronehills.sandwell.sch.uk but resolves to somewhere else at the moment externally.

[DMcCoy]

Did you do a change request? It has to go to RM, who then send it to the LEA for approval then back to RM to action. The chances of them opening port 25 to the world for you are minimal, we have to pay £1500 a year for a smtp feed from the segfl mail servers instead.

[HodgeHi]

Yeah the fax went off over a week ago but i still have not heard from them to say whether it has been accepted or denied or anything.

So how could the ports be blocked if i have my own managed router for the internet. At the moment we have an adsl line from RM who supplied us with their router which is not being used.

 

At the moment we have no connection to our LEA.

[DMcCoy]

If you are connected to rm for your internet then you probably don't have a real internet connection, it will be connected to their internal network. They control everything going in and out to your connection. Until they create their own forwarding rules you aren't going to see any traffic.

[HodgeHi]

That sounds about right to me. When you lookup the routers ip it resolves back to a SOA record for RM.

 

Ok. Thanks for the information. I will need to speak to the guy who was dealing with my query and see how it goes from there.

[DMcCoy]

And just a note to say that your rm router probably doesn't even have the firewall turned on. When I checked the configs for our segfl supplied cisco it wasn't really doing anything at all, its just passes the data through.

[HodgeHi]

So RM have opened the ports to allow the traffic through to our servers now.

they forwarded ports 25,80 and 443 into our network and i can now see our servers from the public IP address.

 

The school guardian is configured to forward the ports into our network from the mid-range of IPs and i have enabled the firewalls on both OD servers.

 

I have enabled only the same ports from "any". I have not used the OS X server firewall in a production environment so would like to clarify the settings if possible. What are the minimum ports needed for http, https and mail?

 

Is that all i need to do with the "any" side of the firewall. I assume that the any means in from the internet.