DMZ給伺服器了.一切都正常.用內部IP連網站正常.外部IP連不上@@求助

我有一台伺服器.架設在家裡.前端是一台IP分享器.我用DMZ的功能把所有的PORT轉到該伺服器上.一切正常
網站是abc.com
外面的人連到該伺服器的網站(abc.com).正常
在家用電腦(在同一個網段).用內部IP連(192.168.xx.xx).正常
在家用電腦(在同一個網段).用外部IP連(abc.com).不正常

這應該要在分享器上設定些什麼吧?有朋友知道嗎?謝謝
我也有碰過耶,但我是用虛擬伺服器 PORT轉換
外部打網址可連,但內部打網址會連不進,Ping網址得到是外部IP
因為電腦多,所以我架DNS解決了,不然是可以改hosts
但也很好奇為什麼要將網址指到內部IP才可連

還是防火牆改成from:any source:any to:wan destination:該虛擬伺服器?
NAT loopback在一般家用設備需要視產品規格而定...
現在普遍一般都有實作...

相愛難胖亦難 wrote:
我也有碰過耶,但我...(恕刪)

using DNS is a alternative solution..

but NAT loopback:
NAT loopback, also known as NAT hairpinning or NAT reflection,[6] is a feature in many consumer routers[7] which allows a user to connect to his/her own public IP address from inside the LAN. This is especially useful when, for example, a website is hosted at that IP address. The following describes an example network:

Public address: 203.0.113.1 (this is the address of the WAN interface on the router)
Internal address of router: 192.168.1.1
Address of the server: 192.168.1.2
Address of a computer: 192.168.1.100
If a packet is sent to the public address (203.0.113.1) by a computer at 192.168.1.100, the packet would normally be routed to the default gateway (the router), unless an explicit route is set in the computer's routing tables. A router with the NAT loopback feature detects that 203.0.113.1 is the address of its WAN interface, and treats the packet as if coming from that interface. It decides based on DNAT (port forwarding) rules on the destination for the packet. For example, if the data were sent to port 80 and there is a DNAT rule for port 80 directed to 192.168.1.2, then the host at that address will receive the packet.

If no applicable DNAT rules are available, the router's firewall drops the packet. An ICMP Destination Unreachable reply may be sent. If any DNAT rules were present, address translation is still in effect; the router still rewrites the source IP address in the packet. The computer (192.168.1.100) sends the packet as coming from 192.168.1.100, but the server (192.168.1.2) receives it as coming from 203.0.113.1. When the server replies the process is identical as for an external sender. Thus, two-way communication is possible between hosts inside the LAN network via their public IP address.

NAT loopback is especially useful when the server hosts a domain name that resolves to a public address. When the router does not perform NAT loopback, any connection attempts to that IP address fail.

vxr wrote:
NAT loopback...(恕刪)


晚來洗安內...謝謝啦

superman.chang wrote:
我用DMZ的功能把所有的PORT轉到該伺服器上


這樣架設風險太大了吧~

用分享器的DMZ功能等於是將伺服器直接擺在網際網路,完全沒有保護吧!

樓主假如要架設對外服務的伺服器,還是建議買台防火牆(PChome上面最便宜的5000元就有找)用它的DMZ功能。

防火牆的DMZ須指定實體IP、埠號與伺服器對應,這樣起碼安全許多~

防火牆的DMZ與分享器的DMZ根本是兩碼子事。

Rayearth wrote:
這樣架設風險太大了...(恕刪)


感謝閣下的提醒.有需要我會去買的.謝謝囉
話說不是每個站都有被駭的風險.當然紅的.大的.有爭議的...等站被攻擊的機會較高.但真正的駭客不是吃飽閒著沒事幹去駭網站.況且網路上有千千萬萬個網站.不須這麼杞人憂天的...況且LINUX不是紙糊的.要有點功力才駭的了..所以目前不擔心

再次感您的建議
superman.chang wrote:
況且LINUX不是紙糊的...(恕刪)


只要是人寫出來的系統就一定會有漏洞。

也不是紅的.大的.有爭議的...的網站才會被駭~

您有聽過 "肉雞" 嗎?

駭客對於肉雞的需求是永遠不嫌多的。

vxr wrote:
NAT loopback...(恕刪)


應該是nat loopback的問題
我以前用520GC刷DD-WRT,
什麼都不懂,只知道在DMZ設定裡打內部IP
就可以把外網IP對應到內部,連進拿來練習的Linux Web Server
結果某天WordPress 網誌被清空、密碼被改掉、後台也進不了
不知道是WordPress還是Linux漏洞造成??我密碼也設的有點複雜阿

想說的是,不止OS、拿來作為服務的套件可能也會有漏洞喔
superman.chang wrote:
感謝閣下的提醒.有...(恕刪)
關閉廣告
文章分享
評分
評分
複製連結

今日熱門文章 網友點擊推薦!