0

for some monitoring purposes on my own software i want to call wget with the "external" UR of the webserver, so my call will look like wget https://www.mydomain.de/path

But this call fails with the error message: Connection failed.

When i make the call from another server / device outside the network from above the call runs without any problems. So my Firewall rules in general are correct i think.

It seems it will be a problem with NATing or something like this.

I am using a Sophos SG UTM als Firewall and inside the DMZ there is a ESX Server with a virtual machine running RHEL 7 and the Apache webserver.

I have the following NAT-Rule configured: Traffic from Internet over https to external interface of Firewall then change destination to Web Server (DNAT). And i have the following Firewall rule configured: Web Server/Nagios over https to Web Server and External Interface.

Note: Nagios is used for other monitoring. I need the wget call inside the speical software running on the server

So in try and error i added the following DNAT-Rule: Traffic from Web Server over https to External Interface the change destination to Web Server.

After that the message connection failed is gone, but a connection will still not be established. So i think there is a problem with the NATing or something like this. I have not that much knowledge in network configuration, so maybe someone can help or give some Approaches or Ideas how to solve it.

Opa114
  • 123

1 Answers1

0

As @HBruijn mentioned in his comment it looks like the "Hairpin NAT" Problem. So the Answer to my problem was to add a new NAT-Rule (Full NAT):

Traffic from Web Server (Internal IP) over https to External Interface then change Destination to Web Server (Internal IP) and change Source to internal address.

In my special case for Sophos UTM this articel provide some information and screenshot: https://community.spiceworks.com/topic/954015-sophos-utm-9-nat-issue-question-dnat-snat-full-nat

Opa114
  • 123