2

I have a CentOS 6.0 web server running httpd, mysql, php, and Joomla 2.5. It has a static, public IP address. I can access the webpage (which is the Joomla management console) by IP address perfectly from inside the LAN.

I went home and tried to connect from behind my router and can't get to the webpage. I can ping and ssh to the server but can't pull the webpage with http. I'm using Chrome for my browser.

Any thoughts?

Edit:

This is the output of iptables --list:

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     udp  --  anywhere             anywhere            udp spt:domain
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request
ACCEPT     icmp --  anywhere             anywhere            icmp echo-reply
ACCEPT     tcp  --  anywhere             anywhere            multiport dports ftp,ssh,http,https state NEW,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     udp  --  anywhere             anywhere            udp dpt:domain
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request
ACCEPT     icmp --  anywhere             anywhere            icmp echo-reply
ACCEPT     tcp  --  anywhere             anywhere            multiport sports ssh,http,https state ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http
Improve this question
10
  • You may not have configured Apache to allow remote connections. Or you might have a misconfigured firewall. Can you post your httpd.conf? Commented Sep 23, 2012 at 22:20
  • You should also check your allow/deny settings in /etc/apache2/sites-available. Commented Sep 23, 2012 at 22:23
  • Can you telnet to port 80 on the web server from a remote location? Commented Sep 23, 2012 at 22:49
  • Yes, probably, but unfortunately apache configuration isn't my forte. I'd look for allow/deny and listen directives. There may be others. Commented Sep 23, 2012 at 22:51
  • @HeatfanJohn No, I cannot telnet to port 80. Commented Sep 23, 2012 at 23:07

3 Answers 3

Reset to default
1

Well, it's been years since I had a problem like this with Apache, but way back when, in the middle ages of the internet, we had to resort to trickery in situations like this.

The basic problem we had was the same. I have a public IP fronting my network, and my Apache server uses a private IP on the LAN, and a loadbalancer was forwarding requests to the public IP back to a series of servers with private IPs.

Using tcpdump, we could see that our HTTP requests were making it to Apache, but Apache wasn't responding, because the requests were coming in to the "public IP", and Apache didn't think it should respond to those requests, because that IP wasn't in it's local interface table.

What fixed it for us was bringing up the public IP address as an IP alias to the loopback interface, with a /32 netmask. ifconfig lo0:1 <IP/32> up as it were. This allowed Apache to believe that it should be responding to those requests.

You need to find out if your requests from the outside are even getting to your Apache. If they're not even making it to the servers, then you need to look at firewalls/routers/acls. If you see the requests with tcpdump, but not in Apache, then you need to look at iptables. If you do see the requests in Apache, but Apache isn't responding to them, you should have information in the access_log and error_log that will give you a clue as to what's going on.

Improve this answer
1
  • Well, if he can ssh, then that's a different issue. Commented Sep 24, 2012 at 6:30
0

At first I would like to see the output of this command at home:

nmap -p 80 <public ip of webserver>

If nmap says filtered, then there is an issue with some firewall. If nmap says closed, then there is an issue with the configuration of your webserver.

Apart from this, I found the output of iptables --list not very useful. The command

iptables --list --verbose

provides much more information. Look at the first rule for example. It seems, that all packets are accepted, but --verbose reveals the truth. You can also see, if packets have been dropped, with the help of rule counters.

I would try this command on your webserver next:

tcpdump -i eth0 dst port 80

in order to see if any packets arrive at your server. Make sure to use the appropriate device name here.

Improve this answer
0

The answer was simple enough. There was a firewall in the way. The university I am at blocks TCP/80 without being explicitly allowed through. I moved the listening port to something above TCP/10,000 (which they do not block) and it worked.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.