How to view website published on DMZ via Webserver on our internal network

Hello Shaun Raven ,

Thank you for reaching out to the community, please refer the following KBA - DNAT 

Hi Vivek,

I tried that suggestion, but no joy I'm afraid.  The article says that this only works is the rule is above the DNAT rule for the published server.  Because the server is published using UTM's Webserver protection feature, I have no control over the rule created by that feature - unless you know otherwise.

Kind regards

Hi Shaun,

I prefer to do this with split DNS, resolving the subdomain for internal users to the internal IP in the DMZ.  Depending on your Web Filtering configuration, you may also need to do something there - if you're still not getting through to the server, check the Web Filtering log.

You might also be interested in DNS best practice.

Cheers - Bob

Hi Bob,

Thanks for replying.  My problem seems to be that I only want my internal users to view the site using the external IP.  I've got a dns server on the local network which has the external ip of the site, and that seems to resolve the name ok

Why only the External IP, Shaun - are you wanting to have their accesses go through Web Server Protection, or ???

Cheers - Bob

Yes Bob - exactly that.  I don't want this particular webserver ANYWHERE near my internal network

Good morning, Shaun,

I should have read your other posts above more closely as it's obvious you wanted to use Web Server Security. 

You can just have internal DNS resolve to an Additional Address on the Internal interface and then create a new Virtual Server for that IP using the same Real Server.  Does that work for you?

Cheers - Bob

Hi Bob,

Sorry Bob, I don't quite follow.

What I really want is my users on the internal network to access the website on it's external IP address.  I don't want them to be able to access the DMZ it's on in any way, and I don't want the webserver to be able to access the internal network.  Can you explain your solution further?

Kind regards - Shaun

Hi Bob,

Sorry Bob, I don't quite follow.

What I really want is my users on the internal network to access the website on it's external IP address.  I don't want them to be able to access the DMZ it's on in any way, and I don't want the webserver to be able to access the internal network.  Can you explain your solution further?

Kind regards - Shaun

Shaun, accesses to the external IP are captured by Webserver Protection because of the definition of the Virtual Server that "listens" on that IP.  To have internal accesses go through Webserver Protection, simply add another Virtual Server definition with an additional address on the Internal interface.  You also need internal DNS to resolve the FQDN to that additional address.  Voila - no direct access locally to that server.

Cheers - Bob

Hi Bob,

So you're effectively publishing it twice?  Once on the External, One on the Internal?

Kind regards,

Shaun

Exactly! 

Cheers - Bob