Shorewall users - Oct 2002 - redirect problem (still)....

Hello, i have souch situation:

My server is running apache on port 80 with mos_ssl disabled - i''am
using STUNNELS for SSL connection, so on the internet my serwer is visible on
both ports: 80 (unsecured) and 443 (secured). Now, if You type:
www.gry.autocom.pl your browser open unsecured site, if You want to go to SSL
site You must type: https://www.gry.autocom.pl . What I want to do, is to
reditect the default request from port 80 to 443, on the firewall. I configured
the shorewall with this line:

REDIRECT net 443 tcp 80 - all

but this doesn''t work.... - when You type unsec. site is not showing -
only secure site is available but you must type exacly "https",

so enyone have any idea how can i manage whit this?


Pozdrawiam,
Serwery Gier Autocom
Zbigniew Żółkiewski
www.gry.autocom.pl

ZbychAutocom wrote:
> Hello, i have souch situation:
>  
> My server is running apache on port 80 with mos_ssl disabled -
i''am
> using STUNNELS for SSL connection, so on the internet my serwer is 
> visible on both ports: 80 (unsecured) and 443 (secured). Now, if You 
> type: www.gry.autocom.pl <http://www.gry.autocom.pl> your browser
open
> unsecured site, if You want to go to SSL site You must type: 
> https://www.gry.autocom.pl . What I want to do, is to reditect the 
> default request from port 80 to 443, on the firewall. I configured the 
> shorewall with this line:
>  
> REDIRECT net 443 tcp 80 - all
>  
> but this doesn''t work.... - when You type unsec. site is not
showing -
> only secure site is available but you must type exacly "https",
>  
> so enyone have any idea how can i manage whit this?
>  
>  
Er -- you also have to open port 80 if you want to allow it:

ACCEPT	net	fw	tcp	80

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
AIM: tmeastep  \ http://www.shorewall.net
ICQ: #60745924  \ teastep@shorewall.net

This won''t work the way you think it will. :)

The reason is that if you specify http:// (causing your browser to connect on
port 80) then your browser is not going to use SSL to make the connection. 
Since you are trying to use the firewall to redirect the connection, the browser
still thinks it''s connecting to port 80, not the secure port 443.  Most
popular browsers (IE, Netscape, Mozzila etc.) won''t
"automatically" detect SSL, so you just end up with a few funny
characters in your browser.

The solution is to use an HTTP redirect from within Apache.  This will let you
specify the URL to redirect to and in this new URL you would specify https.

Check out http://httpd.apache.org/docs/misc/rewriteguide.html for a guide on how
to re-write URLs.  You would rewrite the URL from: http://www.gry.autocom.com.pl
to https://www.gry.autocom.com.pl returning an HTTP response code of 301.

The browser will then automatically try to connect to the redirected URL, and
since that URL specifies https, everything works..

Hope that is helpful,
-Jim Susoy
  ----- Original Message ----- 
  From: ZbychAutocom 
  To: shorewall-users@shorewall.net 
  Sent: Saturday, October 26, 2002 7:41 AM
  Subject: [Shorewall-users] redirect problem (still)....


  Hello, i have souch situation:

  My server is running apache on port 80 with mos_ssl disabled - i''am
using STUNNELS for SSL connection, so on the internet my serwer is visible on
both ports: 80 (unsecured) and 443 (secured). Now, if You type:
www.gry.autocom.pl your browser open unsecured site, if You want to go to SSL
site You must type: https://www.gry.autocom.pl . What I want to do, is to
reditect the default request from port 80 to 443, on the firewall. I configured
the shorewall with this line:

  REDIRECT net 443 tcp 80 - all

  but this doesn''t work.... - when You type unsec. site is not showing
- only secure site is available but you must type exacly "https",

  so enyone have any idea how can i manage whit this?


  Pozdrawiam,
  Serwery Gier Autocom
  Zbigniew Żółkiewski
  www.gry.autocom.pl