Internal PC' s can' t see Internal web server with static external IP- misconfig routes- (outside can)

Forum|Forum|17 years ago
May 6, 2009
4 replies
3289 views

Sorry for the lame title, but I am at wits end, I am going cross eyed here. Plus I can' t just change items since the router is located in a colo about 100 miles away. Here is what I have... Internal Server that is hosting a website, server has a static external IP. Everyone out of the networks behind the FortiGate can see it (from home, office, etc). All internal networks can not access the site. The following IP' s listed are changed for privacy, but here is my info from the colo site, and the way it is setup now- I am pretty sure the issue is with my routing, but I' m afraid to change anything for fear everything becomes inaccessible... From CoLo Setup Sheet: WAN Side of Firewall IP: 60.182.173.217 (unusable) Subnet: 255.255.255.128 Default Gateway: 60.182.173.130 LAN Side of Firewall: 62.217.41.48 (unusable) Subnet: 255.255.255.248 First IP: 62.217.41.49 (assign to your Router/Inside Interface) Available range: 62.217.41.50-54 Broadcast: 62.217.41.55 My ForitGate as configured: Network: Switch- 62.217.41.49/255.255.255.248 Switch Secondary- 10.1.1.1/255.255.222.0 WAN1- 60.182.173.217/255.255.255.128 Router: IP: 10.10.2.0/255.255.255.0 Gateway: 62.217.41.49 Device: Switch IP: 10.1.1.0/255.255.255.0 Gateway: 62.217.41.49 Device: Switch IP: 62.217.41.48/255.255.255.248 Gateway: 62.217.41.49 Device: Switch IP: 0.0.0.0/0.0.0.0 Gateway: 60.182.173.130 Device: wan1 IP: 60.182.173.128/255.255.255.128 Gateway: 60.182.173.130 Device: wan1 On the last route, the IP automatically changes to end with 128 with that subnet. I know I have something very wrong here, but I am just too afraid to touch it when I am not right next to the system, and everything has been working pretty well, but we have an internal system- 10.10.2.10 that needs to access the web server that is sitting on 62.217.41.51, a web server that is available to everyone on the outside. Please advise with any input- feel free to call me an idiot :)

rwpatterson

New Member

OK, i did this and it worked, but I explained it to someone else, and they looked at me like I had 2 heads... (No you' re not an idiot

) Create a policy: Source port: WANx Source range: Inside IP subnet (10.10.2.x/y) Destination port: Wherever that machine resides, be it DMZ, Internal Destination range: the same outside VIP definition NAT enabled. Let me know how that works out...

ede_pfau

SuperUser

Methinks there are some bugs in the IP address definitions: From CoLo Setup Sheet: IP: 60.182.173.217 (unusable) ...but... WAN1- 60.182.173.217/255.255.255.128 so the interface is using the network address. Usable range here is .219 to .254, .217 is the broadcast address of the lower half. Actually, the network mask is too big - comprising 128 addresses, but only 38 are left. Check this with your provider. 60.182.173.217/29 would make sense - mask is 255.255.255.248, first IP=.217, last IP=.222, 6 host IPs in all. So either .217 is usuable or the mask is too big. Secondly, the first route for the 10.10.2.0 net is not used at all, all traffic is going down the default route. That is, to wan1. I wonder where this network comes into existence, out of nothing - no port on your firewall is declared as its gateway, no route, probably no policy permitting traffic to other networks... Now, what you can do is define a secondary IP like 10.10.2.1 on interface " switch" . This creates a route to the primary IP on that interface. You' d still need a policy from ' switch' , address: 10.10.2.0/24, to ' switch' , address: 62.217.41.49/29! so, check with your provider first; set up the 2nd IP on ' switch' and the policy independently. This will not interrupt your access from outside. Keep us posted, please. - Wolfgang

rwpatterson

New Member

ORIGINAL: ede_pfau WAN1- 60.182.173.217/255.255.255.128 so the interface is using the network address. Usable range here is .219 to .254, .217 is the broadcast address of the lower half.

WAN1- 60.182.173.217/255.255.255.128 would be 128 addresses starting at 60.182.173.128 to 60.182.173.255

A

Anonymous_UserAuthor

Contributor III

I have the same problem -- however the thing that concerns me is that it originally WORKED .. and then after about the third reboot it suddenly (consistently) didn' t work. I' ll give this a whirl when I' m back on site and am interested in others. I' ve seen this before on routers where they don' t like to " loop back" without some type of static route or something.

Sign up

Login with SSO

Login to the community

Login with SSO