| Apache and SSH Timed Out - Westell 327WI'm having problems setting up Apache and SSH with my Westell 327W.
I have Verizon DSL -> Westell 327W Modem/Router -> Ubuntu Server with Apache Web Server and SSH Server.
The Ubuntu Server with apache and SSH is the DMZ Host.
Apache and SSH will work good for 5-10 minutes, then when you click on a link or do anything from the apache webpage... Firefox says Connecting to XXX.XXX.XXX.XXX, then it will say Page Load Error. Network Timeout. The server at xxx.xxx.xxx.xxx is taking too long to respond.
I putty (ssh) into the Ubuntu server, everything will work good for 5-10 minutes, then putty will freeze up and say Putty Fatal Error. Network error: Software caused connection abort.
Apache or SSH will NOT work for 1-2 minutes. Firefox will say Network Timeout and SSH will not connect at all.
Then, everything will work again for 5-10 more minutes... then go down for 1-2 minutes, over and over and over....
I read the Harden Your Westell 327 Firewall post @ »Harden Your Westell 327 Firewall , and read about the state table... but I still have something wrong because everything is still timing out.
My Inbound Rules:
title [ Security Level Custom (Low) IN rules ]
begin
TTL
drop match 3 8 { 00:FF } >> done, alert 4 [TTL of 0]
drop match 3 8 { 01:FF } >> done, alert 4 [TTL of 1]
Address
drop from addr 0.0.0.0 >> done, alert 4 [0.0.0.0 Source IP Address]
ICMP
pass protocol icmp, icmp-type exceeded >> done
drop protocol icmp, icmp-type reply >> done, alert 3 [ICMP Message To WAN IP - Echo Reply - Dropped]
drop protocol icmp, icmp-type exceeded >> done, alert 3 [ICMP Message To WAN IP - TTL Exceeded - Dropped]
drop protocol icmp, icmp-type unreachable >> done, alert 3 [ICMP Message To WAN IP - Dst Unreachable - Dropped]
drop protocol icmp, icmp-type request >> done, alert 3 [ICMP Message To WAN IP - Echo Request - Dropped]
drop protocol icmp >> done, alert 3 [ICMP Message To WAN IP - Dropped]
Permitted
pass all >> state
end
My Outbound Rules:
title [ Security Level Custom (Low) OUT rules ]
begin
WWW
pass protocol tcp, to port 80 >> state
pass protocol tcp, from port 80 >> state
ICMP
pass protocol icmp, icmp-type request >> state, done
drop protocol icmp, icmp-type reply >> done, alert 2 [ICMP - Echo Reply - Drop]
drop protocol icmp, icmp-type exceeded >> done, alert 2 [ICMP - TTL Exceeded - Drop]
drop protocol icmp, icmp-type unreachable >> done, alert 2 [ICMP - Dst Unreachable - Drop]
drop protocol icmp, icmp-type request >> done, alert 1 [ICMP - Echo Request - Drop]
drop protocol icmp >> done, alert 2 [ICMP - Prohibited Type - Drop]
NetBIOS
drop to port >= 135, to port <= 139 >> done, alert 4 [Dropping NetBIOS Traffic]
Rules
RulesSaveState
Permitted
pass all >> state
end
All I need is Apache Webserver on port 80, and SSH Server on port 22. I dont care about the other ICMP and NetBIOS stuff.
Can somebody help me plz? |
 nwrickertsand groperPremium,MVM
join:2004-09-04
Geneva, IL
kudos:7
 ·AT&T U-Verse
| Try turning off the firewall. If it still does not work, then you will know that it isn't a firewall problem.
Incidently, I have had no problems with SSH, or with email. I am not using DMZ, but I do port-forward ports 22 and 25 to my server.
--
AT&T dsl; Speedstream 5100b modem; openSuSE 11.0; firefox 3.0.11 |
| I disabled DMZ host for Ubuntu Server and setup port forwarding on the Westell 327w.
I can access apache from my computer on the LAN using its private 192.168.1.xxx IP, but I cant access it from my external public WAN IP.
I accessed the webserver from my friends house. I can access it, but I didnt have time to see if it still timed out.
When I received the timeout.... I accessed the website, clicked a few links, let it set idle for about 10 minutes, then when I click on another link it would time out. Sometimes it would timeout without letting it idle...
CHECK IT OUT:
»141.153.51.94
Tell me if it times out and if its very slow.... |
nwrickertsand groperPremium,MVM
join:2004-09-04
Geneva, IL
kudos:7 Reviews:
·AT&T U-Verse
| Okay, I can contact the web server. It's looking fine from here.
I think you are confused about the loopback. Most home routers, including the 327w, do not support loopback. That means that you properly access the public IP address from within the private LAN. So to test, you need to do from your friend's house or by use of an external proxy.
I also seem to be able to access the SSH, though I cannot login as I don't have an account there.
I hope this is useful.
--
AT&T dsl; Speedstream 5100b modem; openSuSE 11.0; firefox 3.0.11 |
