Каталог Поиск 0 Сравнить 0 Закладки 0 Корзина Войти
Каталог
105082, Москва, ул. Фридриха Энгельса, 75с21, БЦ Бауманский ИТКОЛ
Пн - Пт: с 09-00 до 18-00 Сб: с 10-00 до 18-00 Вс: выходной
Страницы: 1
RSS
Внутреннее перенаправление по SSID, UniFi Network
 
ПОЖАЛУЙСТА, помогите... Мне нужно перенаправить соединения на наш публичный мобильный сайт на внутренний веб-сервер, при этом порты должны меняться в зависимости от сети, из которой идет трафик:  
- eth1 на 802  
- eth1.2 на 802  
- eth1.3 на 803  
- eth1.4 на 804  

Через GUI это сделать нельзя, поэтому я настроил весь файрвол, проброс портов и применил правки через CLI:  
configureset service nat rule 50 description "OranaWiFi to Webserver"  
set service nat rule 50 type destination  
set service nat rule 50 inbound-interface eth1.2  
set service nat rule 50 destination address 138.128.191.146  
set service nat rule 50 destination port 80  
set service nat rule 50 inside-address address 192.168.1.250  
set service nat rule 50 inside-address port 802  
set service nat rule 50 protocol tcp  

set service nat rule 51 description "SchoolWiFi1 to Webserver"  
set service nat rule 51 type destination  
set service nat rule 51 inbound-interface eth1.3  
set service nat rule 51 destination address 138.128.191.146  
set service nat rule 51 destination port 80  
set service nat rule 51 inside-address address 192.168.1.250  
set service nat rule 51 inside-address port 803  
set service nat rule 51 protocol tcp  

set service nat rule 52 description "SchoolWiFi2 to Webserver"  
set service nat rule 52 type destination  
set service nat rule 52 inbound-interface eth1.4  
set service nat rule 52 destination address 138.128.191.146  
set service nat rule 52 destination port 80  
set service nat rule 52 inside-address address 192.168.1.250  
set service nat rule 52 inside-address port 804  
set service nat rule 52 protocol tcp  

set service nat rule 53 description "OranaNet to Webserver"  
set service nat rule 53 type destination  
set service nat rule 53 inbound-interface eth1  
set service nat rule 53 destination address 138.128.191.146  
set service nat rule 53 destination port 80  
set service nat rule 53 inside-address address 192.168.1.250  
set service nat rule 53 inside-address port 802  
set service nat rule 53 protocol tcp  

set service nat rule 5001 type source  
set service nat rule 5001 source address 192.168.1.250  
set service nat rule 5001 outbound-interface eth1  
set service nat rule 5001 outside-address address 138.128.191.146  

commit;  
save;  
exit  

НО это не работает!
 
USG is definitely capable of hairpin NAT/NAT reflection. But like


@doktornotor


it's more so thought of as a workaround or band-aid instead of using something more practical like split-DNS or a reverse-proxy. I was pretty confident in the last set of commands I sent you - I'd have to see why they're not working in a screenshare and try to fix it from there.
 
I frankly have no idea whether USG is capable of that using some JSON stuff. As you noticed, I consider the hairpin NAT to be a bandaid/hack at best, plus an unflexible PITA. Definitely not a fan of playing ping-pong with the packets, plus this route did not get you anywhere for over a year. If you don't want a reverse proxy, you might just make use of BIND and its views feature to resolve the DNS to different IPs depending on SSID/client subnet, and configure virtual hosts per IP (instead of ports) to serve what's needed. (Any access restrictions can done on the webserver as well.) Now all of this can run on standard 80/443, no need for 801/802/803/804/etc. redirects. Or, maybe the webserver you are using can do that based on the client IP on it's own. E.g., you can do things like this with recent Apache versions: <If "%{REMOTE_ADDR} -ipmatch '192.168.1.0/24'">
...
</If>Or, Apache can work as a reverse proxy as well. Altogether - it'd be a whole lot better to describe your goal and let people work with that, instead of describing one possible solution that you have chosen to reach that goal and that clearly has not worked for you plus did not trigger any workable suggestions on how to make it work so far.
 
I will try it, thanks! I'm assuming that this means that the USG is incapable of achieving this?(Every other suggestion has insisted the USG is capable of hairpin NAT or I would not have pursued it) I dont see why hairpin NAT is a "clusterfsk" or "BS"?(My aim was to unify all roles within UniFi and simplify management when I remover the infinitely more manageable MikroTik RB750UP - this adds far more complexity with DNS entries on DC, HAproxy to redirect...) So before I complicate the arrangement...definitively: the Unifi USG can NOT hairpin NAT?
 
Instead of this BS. 1/ Fix your internal DNS so that it points to the webserver. Not to your router's WAN. WTF. 2/ Let the webserver listen on localhost ONLY and use a goddamn reverse proxy (such as HAproxy) to redirect people to the proper website port depending on which subnet they did come from. (Alternatively, the reverse proxy can run on another machine, the DNS should be pointing there if that's the case.) No hairpin/NAT reflection/loopback clusterfsck needed. Shouldn't take more than an hour to set up.
 
@UBNT-jaffe


this does not work...at all.My original code at least functioned on "OranaNet" corporate but not the others whereas this works on none.Why is this so hard to achieve on USG?
Страницы: 1
Читают тему (гостей: 1)