How to access website through LAN and security issues?

NeddySeagoon · Posted: Sun Feb 21, 2016 8:02 pm Post subject:

gordonb3,

Its more the on site backup and off site backup concept.

When at any time, for whatever reason, you are down to a single copy, you no longer have a backup.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

gordonb3 · Apprentice Joined: 01 Jul 2015 Posts: 185

I understand what you are saying, but again: you are assuming a situation where the backup data can be used as a working set. Particularly when databases are concerned the backup may not be in any running format or the backup machine not capable of serving the database. In many many cases the backup can only be used to restore something, if even a completely new machine. Meaning the backup will still be the backup rather than the new running environment, as would be the case in a redundancy cluster. Which by definition is not a backup at all.

paul_chany

I red this topic and want to set my home server too to be reachable from the Internet.
I'm connected to my ISP through a cable modem.

NeddySeagoon · Posted: Sat Mar 12, 2016 10:25 am Post subject:

paul_chany,

A few choices
You need to Destination Network Address Translation (DNAT) port 80 from your public IP to RasPi, so that Web traffic from the internet arrives at RasPi. You may also need to DNAT port 443. That's for https.

You may also choose to forward (no DNAT) packets on port 80/443 RasPi, in which case your webserver needs to listen on your public IP.
That's only useful if you have a static public IP.

If you have a dynamic public IP, you need to sign up to a service like no-ip. They will give you a no-ip. URL that points to your IP, whatever it happens to be at the time.

If your public IP is static, you update the authorative nameservers for your FQDN to point to your static public IP.

Now it gets messy. You should not need to do any of this, but you need to be aware of it.
Some ISPs block some incoming ports. This is to stop you running your own servers.
The work around is to use non-standard ports. This will prevent most users reaching your servers.

In the UK, a lot of cable subscribers don't even have a public IP, Their ISP keeps them behind NAT. Then its game over. You cannot be reached from the internet.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

paul_chany · Posted: Sat Mar 12, 2016 5:00 pm Post subject:

NeddySeagoon · Posted: Sat Mar 12, 2016 5:29 pm Post subject:

paul_chany,

You don't need a public IP on RasPi. You have DNAT.

If you forward port 80, without DNAT, packets with <Public_IP>:80 appear on your LAN.
RasPi can deal with them. However, it now needs to deal with a dynamic IP address too.
DNAT is a better solution.

When a packet arrives at <Public_IP>:80, its NATted to 192.168.50.200:80
Your router saves this information, so that replies get sent back to original requester.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

paul_chany · Posted: Sat Mar 12, 2016 5:52 pm Post subject:

NeddySeagoon · Posted: Sat Mar 12, 2016 6:16 pm Post subject:

paul_chany,

First, can you browse RasPi from your own LAN.

paul_chany · Posted: Sat Mar 12, 2016 7:06 pm Post subject:

NeddySeagoon · Posted: Sat Mar 12, 2016 8:39 pm Post subject:

paul_chany,

I can both ping cspl.hu and browse http://www.cspl.hu/.
It says Kistechnikusok távképzése and links to the Free Software Foundation.

I thought I recognised shorewall.

The firewall is its own zone in Shorewall, so you have three zones called net, fw and loc.

My rule to do DNAT for my webserver is

paul_chany · Posted: Sat Mar 12, 2016 8:47 pm Post subject:

NeddySeagoon · Posted: Sat Mar 12, 2016 8:58 pm Post subject:

paul_chany,

paul_chany · Posted: Sat Mar 12, 2016 9:16 pm Post subject:

NeddySeagoon · Posted: Sat Mar 12, 2016 9:50 pm Post subject:

paul_chany,

From your link, the two rules look to be the same.

You can't reach http://cspl.hu from your LAN as even when its working, it will resolve to your public IP.
That needs another DNAT rule

paul_chany · Posted: Sun Mar 13, 2016 8:03 am Post subject:

Hi Neddy,

NeddySeagoon · Posted: Sun Mar 13, 2016 11:00 am Post subject:

paul_chany,

It won't work until http://cspl.hu points to your public IP.

When I wrote last http://cspl.hu pointed to 192.184.88.81 and your public IP was 95.85.141.171

If you write the rule as

paul_chany · Posted: Sun Mar 13, 2016 11:41 am Post subject:

Hi Neddy,

NeddySeagoon · Posted: Sun Mar 13, 2016 12:03 pm Post subject:

paul_chany,

As you have this rule,

paul_chany · Posted: Sun Mar 13, 2016 12:07 pm Post subject:

Neddy,

NeddySeagoon · Posted: Sun Mar 13, 2016 7:32 pm Post subject:

paul_chany,

I thought I understood your network topology, now its clear that I don't.

paul_chany · Posted: Sun Mar 13, 2016 7:45 pm Post subject:

NeddySeagoon · Posted: Sun Mar 13, 2016 8:28 pm Post subject:

paul_chany,

A network bridge always has two or more interfaces. It connects the subnets on all the member networks together.
Its just like a road bridge. To be useful, it needs two (or more) ends.
Its the software equivalent of a hardware network hub, all packets go everywhere.

Would you try to cross a road bridge that had only one end?

More seriously, is it possible that you intended to add more devices later and later never arrived?
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.