Apache Running on a Server Behind a NAT Firewall

If your Web server is behind a NAT firewall and you are logged on a machine behind the firewall as well, then you may encounter problems when trying to access www.mysite.com of www.another-web-site.org. Because of NAT (network address translation), firewalls frequently don't allow access from their protected network to IP addresses that they masquerade on the outside.

For example, Linux Web server Bigboy has an internal IP address of 192.168.1.100, but the firewall presents it to the world with an external IP address of 97.158.253.26 via NAT/masquerading. If you are on the inside, 192.168.1.X network, you may find it impossible to hit URLs that resolve in DNS to 97.158.253.26.

There is a two-part solution to this problem:

Step 1: Configure Virtual Hosting on Multiple IPs

You can configure Apache to serve the correct content when accessing www.mysite.com or www.another-web-site.org from the outside, and also when accessing the specific IP address 192.168.1.100 from the inside. Fortunately Apache allows you to specify multiple IP addresses in the <VirtualHost> statements to help you overcome this problem.

Here is an example:

     NameVirtualHost 192.168.1.100
     NameVirtualHost 97.158.253.26

     <VirtualHost 192.168.1.100 97.158.253.26>
         DocumentRoot /www/server1
         ServerName www.my-web-site.org
         ServerAlias bigboy, www.another-web-site.org
     </VirtualHost>

Step 2: Configure DNS Views

You now need to fix the DNS problem that NAT creates. Users on the Internet need to access IP address 97.158.253.26 when visiting www.my-web-site.org and users on your home network need to access IP address 192.168.1.100 when visiting the same site.

You can configure your DNS server to use views which makes your DNS server give different results depending on the source IP address of the Web surfer's PC doing the query. Chapter 18 explains how to do this in detail.

Tip If you have to rely on someone else to do the DNS change, then you can edit your PC's hosts file as a quick and dirty temporary solution to the problem. Remember that this will fix the problem on your PC alone.