Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 1 down vote favorite

I have an Ubuntu firewall box (Alma), at the office, with a web server on it. It looks like this:

[Internet] <-> [DSL Router] <-> [Alma]
                                   |
                  [DMZ:10.1...] <--+--> [Internal LAN:192...]

Whenever I am at home, outside of Alma, I can get to it just fine through SSH. When I am inside, on the internal LAN I cannot use the public IP address to log in to the box, but instead must use the local subnet 192... Alma has 3 NIC interfaces.

I'd like to be able to script some things using a single public IP address. Let's say it is 7.7.7.7. This problem prevents doing that easily. Is there a way to make this command:

ssh 7.7.7.7

work from inside on the 192 subnet as well as the internet? The odd thing is that I can ping 7.7.7.7 from inside or outside just fine. But when I try to SSH to 7.7.7.7 from inside, the connection is refused.

What am I doing wrong, or not doing correctly?

My SSH daemon listens on 0.0.0.0. The firewall logs no attempt at all when I try from inside.

Any help is appreciated.

share|improve this question
1  
Is your firewall blocking outgoing SSH traffic? – Kevin Jan 25 '12 at 15:59
I have to ask is there any reason why you are even allowing SSH traffic into your firewall from outside? And secondly is there any reason why you just won't alias a hostname to external address when you are home and internal address when you are at work? – Karlson Jan 25 '12 at 16:04
1  
Sounds like a NAT Loopback issue , whats the model of your router? – shutupsquare Jan 25 '12 at 16:09
Kevin, my firewall is not blocking ssh traffic. I can ssh to any open host on the net. – Midwire Jan 26 '12 at 15:50
Karlson, I allow ssh traffic into my firewall because I want to be able to administer/make changes to stuff at the office from home. Aliasing a hostname can be done but that means whenever I move between office and home I have to edit the hosts file. I can do that but I'd rather not. I should be able to access a given IP address the same way, whether I'm inside or outside the LAN. – Midwire Jan 26 '12 at 15:53
show 1 more comment

1 Answer

up vote 2 down vote

Another approach would bo set up a local dns server and use names instead of ip addresses. The concept is called Split horizon DNS. your-machine.yourdomain.com would resolve to 10.0.0.7 locally, and 7.7.7.7 when used externally.

See also: Split horizon

And I personally would recommend to use djbdns (or a fork of it) and not bind.

share|improve this answer
reto, I'm familiar with Split Horizon DNS. I'd rather solve the real issue instead of trying to work around it. It just seems to me that I should be able to do this without a workaround. – Midwire Jan 26 '12 at 15:56
NAT is ugly.. it should have never been invented. – reto Jan 26 '12 at 16:08
I cannot disagree with that. It does seem like its trying to do double NAT. NAT out to public IP, NAT in to firewall. – Midwire Jan 26 '12 at 17:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.