Shorewall users - Dec 2011 - See dmz sites from Inside dmz

There is probably a simple solution to this, but I think I''ve wrapped
myself up in my underwear and can''t see my way <sigh>

I''m trying to get to web sites on my DMZ from other machines on my DMZ,
by
using the external IP.  This fails with a timeout error.


I''m running a 3-interface Shorewall 3.2.6 on Debian 5.x Stable
(It''s
worked great for years, so I haven''t touched it!)  My web site has an
external IP address, which forwards to my server on the DMZ.  I can access
the web sites perfectly from my "loc" systems by referencing the
external
IP address.  However, I __cannot__ do the same from within the DMZ. 
Trying to access them from within the DMZ leads to a timeout error.  By
specifying the actual IP address within the DMZ, I am able to access the
web site, but not by using the external IP.

Is it possible to use the external IP address to bounce back into the DMZ?


Thanks in advance for any help or suggestions for troubleshooting. 
I''ve
enclosed my shorewall dump.


-- 
Casey Bralla
Chief Nerd in Residence
The NerdWorld Organisation

------------------------------------------------------------------------------
All the data continuously generated in your IT infrastructure 
contains a definitive record of customers, application performance, 
security threats, fraudulent activity, and more. Splunk takes this 
data and makes sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-novd2d

On Sun, 2011-12-04 at 08:34 -0500, Casey Bralla wrote:
> There is probably a simple solution to this, but I think I''ve
wrapped
> myself up in my underwear and can''t see my way <sigh>
> 
> I''m trying to get to web sites on my DMZ from other machines on my
DMZ, by
> using the external IP.  This fails with a timeout error.
> 
> 
> I''m running a 3-interface Shorewall 3.2.6 on Debian 5.x Stable
(It''s
> worked great for years, so I haven''t touched it!)  My web site has
an
> external IP address, which forwards to my server on the DMZ.  I can access
> the web sites perfectly from my "loc" systems by referencing the
external
> IP address.  However, I __cannot__ do the same from within the DMZ. 
> Trying to access them from within the DMZ leads to a timeout error.  By
> specifying the actual IP address within the DMZ, I am able to access the
> web site, but not by using the external IP.
> 
> Is it possible to use the external IP address to bounce back into the DMZ?

See Shorewall FAQ 2.

-Tom
-- 
Tom Eastep        \ When I die, I want to go like my Grandfather who
Shoreline,         \ died peacefully in his sleep. Not screaming like
Washington, USA     \ all of the passengers in his car
http://shorewall.net \________________________________________________





------------------------------------------------------------------------------
All the data continuously generated in your IT infrastructure 
contains a definitive record of customers, application performance, 
security threats, fraudulent activity, and more. Splunk takes this 
data and makes sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-novd2d