I've got a very simple network setup :

Local Network : 192.168.0.0/24
DMZ : 10.10.10.0/24

I've got a server on the DMZ and a rule setup on the firewall to send HTTP traffic to it. It all works well for external users.

The issue is from within the local network. When you try to reach the server using the public IP address you can't get through. If you use the local address then it works just fine. You just cant use the public address.

I've got a rule temporarily in place that allows full access between the DMZ and Local Network so that's not an issue.

Just wanted to check encase it's a really obviously stupid thing going on here. I'm guessing yes.

__________________
Mooharr
E-Mail Hosting Services
These are not my views and i cannot be held accountable for anything he says.

__________________
Web Host - VIP Member

AFAIK that's perfectly standard behaviour that the LAN can't talk to the DMZ on the public IP address as you'd have a 3-way NAT going on.

__________________
Karl Austin :: Owner :: Director :: Admin :: Tea Boy
KDA Web Services Ltd. :: 0800 542 9764 :: Company: 04114724 :: VAT: GB 842 9597 81
"Individual Solutions for Individual Customers" - Call us today for free

Only two things are infinite, the universe and human stupidity, and I'm not sure about the former. - Einstein

__________________
Web Host - VIP Member

I've always hit the same problem myself. The only fix I can think of is to use DNS names. On a small network of a couple of PCs just modify the HOSTS files on Windows computers, put the name and the DMZ address. On larger networks messing around with the DNS server can create a fix.

You should be able to create a similar rule for LAN users to access the DMZ only on port 80/443 to stop open access.

Michael

__________________
Registered User

What device is the DMZ setup on. Most have a nat loopback option to sort it. If its something Cisco then I can give you the command set, the rest would just be generic help!

__________________
CCS Leeds Ltd

Company reg: 03507910 VAT reg: GB 698 2027 05
------------------------------------------------
For all your Broadband / DSL, MLPPP Bonded, Leased Lines
and Web Hosting needs why not pop over to CCS Leeds Ltd
------------------------------------------------

__________________
Web Host - Certified Member

Out Packets: Client: 192.168.0.x --> NAT --> Public IP --> NAT --> DMZ: 10.10.10.x
Return Packets: DMZ: 10.10.10.x --> NAT --> Public IP --> NAT --> Client: 192.168.0.x

....not pretty.

__________________
••• Mark Castle ••• Secura Hosting Ltd •••
••• Managed Hosting •••
••• AS29452 • UK Company Reg No: 04330657 • VAT Number: 789 2703 81 • Sales: 0845 123 2632 •••
My views are my own and not those of my company.

__________________
Web Host - VIP Member