Computer (networking) experts

[sam_gordon]

This is not my setup, I'm trying to help someone and have exhausted my limited knowledge about networking...

Server A hosts a website. The server is behind a firewall. Server A's webpage can be reached from the internet.
Server A's webpage has links (via name, not IP) to Servers B & C (each with their own webpage), which is also behind the firewall.
When accessing Server A from the private network (NOT a domain if that makes a difference), the links to Server B & C work.
When accessing Server A from the internet, Server A's webpage displays correctly. But if you click on the link to Server B or C, you get a message saying "serverb\webpage can not be found".

So it sounds like a DNS issue to me (can't resolve the IP address from the name), but only when you access from the public internet.
I get that the DNS servers on the internet know when you go to website.serverA.com, it gets pointed to the public IP for the firewall. The firewall/router knows to resolve to the "local" IP for serverA.

But how/where do you tell those outside computers to use the "private" DNS server? In the firewall? Another server?

As much as I'd like to try it, we can NOT change the links on A's webpage to IP.

If anyone has suggestions, it would be appreciated.

 

[dizneegirl]

You are correct. It is a DNS issue.

The firewall needs to properly route external traffic (dns masq).

Or it could be an SOA issue with the A record. Google search would help with that.

 

[sam_gordon]

You are correct. It is a DNS issue.

The firewall needs to properly route external traffic (dns masq).

Or it could be an SOA issue with the A record. Google search would help with that.

Sorry, still confused. Maybe if I get a a look at their firewall configs.

 

[Orcmeat]

might also ensure the browser allow cross site access....but sounds like dns

 

[Orcmeat]

Also on this statement "But how/where do you tell those outside computers to use the "private" DNS server? In the firewall? Another server?"... the end user should not be having to do anything with dns, this is the server not properly routing....i'd also check the webserver logs to see what it tried to do.

 

[sam_gordon]

Also on this statement "But how/where do you tell those outside computers to use the "private" DNS server? In the firewall? Another server?"... the end user should not be having to do anything with dns, this is the server not properly routing....i'd also check the webserver logs to see what it tried to do.

Which server not properly routing? Server A? DNS Server? Router?

 

[GreatLakes]

When an end user is attached to server A and clicks a link to server B or C are they sent to a page hosted on that server or is server A pulling in content from Servers B and C and displaying it on a page server A is hosting? If it is the former it isn't going to work unless servers B and C have public DNS records. If it is supposed to be the later it sounds like something is set up wrong.

In your description it sounds like servers B and C should be serving data or services to Server A, not to any outside party directly.

I'm hoping Server A is in a DMZ if it is publicly accessible. If servers B and C are inside a private perimeter because they host private data then it could also be a firewall rule not allowing that data back to server A as well. That is assuming everything is configured to allow server A to present any data from B and C without trying to send visitors to those servers.

 

[sam_gordon]

When an end user is attached to server A and clicks a link to server B or C are they sent to a page hosted on that server or is server A pulling in content from Servers B and C and displaying it on a page server A is hosting? If it is the former it isn't going to work unless servers B and C have public DNS records. If it is supposed to be the later it sounds like something is set up wrong.

In your description it sounds like servers B and C should be serving data or services to Server A, not to any outside party directly.

I'm hoping Server A is in a DMZ if it is publicly accessible. If servers B and C are inside a private perimeter because they host private data then it could also be a firewall rule not allowing that data back to server A as well. That is assuming everything is configured to allow server A to present any data from B and C without trying to send visitors to those servers.

If I understand correctly, the content from Servers B and C are displayed on Server A's page. Pretty sure the address doesn't change. I'll look.

I do think it's a configuration issue, but not sure what to suggest to change.

 

[Orcmeat]

Which server not properly routing? Server A? DNS Server? Router?

It depends on how server A is presenting these links to the end user...is it resolving the content and then displaying it to the user? (then it is a server a issue), but if you are just putting links out for the browser to resolve then it could be a browser issue. most browsers will block links from redirecting you to a 3rd site (xss hacks)

 

[GreatLakes]

This is not my setup, I'm trying to help someone and have exhausted my limited knowledge about networking...

Server A hosts a website. The server is behind a firewall. Server A's webpage can be reached from the internet.
Server A's webpage has links (via name, not IP) to Servers B & C (each with their own webpage), which is also behind the firewall.
When accessing Server A from the private network (NOT a domain if that makes a difference), the links to Server B & C work.
When accessing Server A from the internet, Server A's webpage displays correctly. But if you click on the link to Server B or C, you get a message saying "serverb\webpage can not be found".

So it sounds like a DNS issue to me (can't resolve the IP address from the name), but only when you access from the public internet.
I get that the DNS servers on the internet know when you go to website.serverA.com, it gets pointed to the public IP for the firewall. The firewall/router knows to resolve to the "local" IP for serverA.

But how/where do you tell those outside computers to use the "private" DNS server? In the firewall? Another server?

As much as I'd like to try it, we can NOT change the links on A's webpage to IP.

If anyone has suggestions, it would be appreciated.

What is the reason for the bolded? Are all three servers in the same zone?

 

[sam_gordon]

What is the reason for the bolded? Are all three servers in the same zone?

It's not a web page I have design/edit control over.

 

[DisneyTarheel]

A few suggestions from my trusty AI:

“The issue you're experiencing seems to be related to your firewall and DNS settings. The firewall appears to be correctly configured to allow traffic to Server A from the internet, but it's not allowing traffic to Server B and C from the internet. Also, the DNS resolution from the internet might not be correctly set up for Servers B and C.

Here are some steps you might take to resolve this issue:

1. Update Firewall Settings: Check the firewall rules and ensure that traffic from the internet is allowed to reach Servers B and C. This might involve creating NAT (Network Address Translation) rules or port forwarding rules in your firewall to direct incoming requests to the appropriate server.
2. DNS Configuration: When the server links are specified by name (not IP), the client browser needs to resolve those names to IP addresses. Inside your private network, this is probably working fine, but over the internet, this DNS resolution might not work if the DNS for Server B and C are not publicly accessible. You may need to set up public DNS entries for these servers, which would direct users to the correct IP addresses when accessed from the internet.
3. Fully Qualified Domain Names (FQDN): It may also be a good idea to use Fully Qualified Domain Names (FQDN) in your links if you're not already doing so. A FQDN includes the full site name and domain, like 'serverb.example.com', rather than just 'serverb'. This can help ensure that the DNS lookups are correctly finding your servers.
4. Reverse Proxy: Another approach, especially if you do not want to expose Server B and C directly to the internet, is to use Server A as a reverse proxy for Servers B and C. This would mean that all traffic comes to Server A, which then forwards it on to Server B or C as needed, and sends the response back to the client. This has the added benefit of hiding the existence and details of Server B and C from the public.

Remember, it is important to consider the security implications of these changes. Exposing more servers to the internet, opening more ports, and adding more public DNS entries all potentially increase your security risk. So, always balance your network configuration changes with the necessary security measures. It might be beneficial to consult with a network security expert when making these types of changes.”

 

[sam_gordon]

We don't want to expose B and C to internet. So the reverse proxy sounds closest to what we want to do. Thanks for the suggestion.