On Sun, 10 Jul 2005, Andrew Walters wrote:

> My 3Com OfficeConnect router handles it fine. It simply routes internal conxns
> going to whatever happens to be its public IP address back to itself and
> through the appropriately forwarded port.
>

yup, and it means its broken because that would mean that it is not
reporting the source IP correctly which could cause issues.

think about this.

192.168.1.1 talks to 1.2.3.4 (your public ip), this then translates to
192.168.1.200 (your server) and forwards a request through saying
"192.168.1.1 is talking to 192.168.1.200 on the web port"

so 192.168.1.200 tries to reply to 192.168.1.1 and seeing as it is on the
local subnet, responds directly (shortest path, directly connected links
take precidence) - as a result, 192.168.1.1 who thinks it is talking to
1.2.3.4 gets an answer from 192.168.1.200 and says "bugger off, i'm not
talking to you" and throws the packet away.

For this to work the host 192.168.1.200 would either have to force all
traffic via its default route (assuming this is the NAT device) and ignore
local precidence or the NAT device would have to do source NATting as well
as Destination NAT which would tend to break logs.

> (Does this mean it may be breaking an RFC? dunno)

Probably, tho that doesnt tend to be the end of the world - it will
probably produce some rather interesting results in certain situations
however and may also be a security problem allowing someone to spoof your
internal network and cause havok.

The "correct" way to do this would be to run an internal DNS server and
use that as your primary for internal hosts, set internal domains to their
corerect internal addresses and then use domain names instead of IP
addresses. (you could probably subnet your internal network as well which
would probably produce a similar result.

-- 
Steve.
>
> Andrew
>
> On Thu, 07 Jul 2005 13:43, you wrote:
> | > Hi
> | > Can someone explain why ,
> | > on my nokia m1122 , I can't goto mydomain.com  from inside my lan ,
> | > but on another router It works fine.
> |
> | So youre on the inside of a NAT interface, trying to talk directly to the
> | outside of your NAT interface?
> |
> | It doesn't work.
> |
> | Its also well documented...
> |
> | Simply put...
> --
> This message is part of the NZ ADSL mailing list.
> see http://unixathome.org/adsl/ for archives, FAQ,
> and various documents.
> To unsubscribe: send mail to majordomo@lists.unixathome.org
> with "unsubscribe adsl" in the body of the message
>
>
-- 
This message is part of the NZ ADSL mailing list. 
see http://unixathome.org/adsl/ for archives, FAQ, 
and various documents. 
To unsubscribe: send mail to majordomo@lists.unixathome.org 
with "unsubscribe adsl" in the body of the message