[BlueOnyx:26225] Re: IP Loopback

[Colin Jack]

Solved it … not BX at all.
Poisoned domain DNS carried out by someone!

Thanks

Colin

From: Blueonyx <blueonyx-bounces at mail.blueonyx.it> on behalf of Colin Jack <colin at mainline.co.uk>
Reply to: BlueOnyx General Mailing List <blueonyx at mail.blueonyx.it>
Date: Monday, 22 May 2023 at 19:41
To: BlueOnyx General Mailing List <blueonyx at mail.blueonyx.it>
Subject: [BlueOnyx:26223] IP Loopback

I wonder if anyone can help with an issue that I have spent days on and cannot resolve!

We have a customer with a 5209R server running on their LAN.
They have a DNS record for an external host address which points to the WAN interface on their firewall and is then NAT through to the BX box for 80 and 443. All works fine.

I have set up a loopback / hairclip rule on their firewall so users can access the server from the LAN using the FQDN.

They also have a VLAN which uses a different subnet internally to the subnet that the server sits on.

If users come from the VLAN it works fine (so different internal subnet) using the FQDN.
If they come from the same subnet it fails – but if I SSH to the BX server (using FQDN) from the same subnet it works. So loopback is working.
So it appears to be Apache that is rejecting it if it loops back from the same subnet?

The firewall logs show the BX server rejecting the ACK when looped back from the same LAN.

If they connect using internal IP on the same LAN it is fine – only fails on the loopback using FQDN.

Does this make sense? <grin>.

It is almost as if apache is seeing a spoof and rejecting it? Nothing in the HTTPD error_log.
Cleared iptables and not running APF …

Thanks

Colin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.blueonyx.it/pipermail/blueonyx/attachments/20230522/782069cb/attachment.html>