Web Server firewalld question

[circuitbear]

Alright, so this is a bit all over the place and I am trying to isolate the issue.

Short version. My web server is running, and while in the same network as the server, with a hostfile pointing to it, you can access the site. Trying to hit the site from outside the network causes almost no reaction from the browser, in firefox it just simply hangs.

To give a basic idea of the environment I am working in. I am setup in a household with a main router which we opened a DMZ to a secondary router. The secondary router has a rule to drop any packets to any internal ip not inside of its own little environment. This setup let me create a TeamSpeak server on a Linux server os relatively easily. Now when I created my webserver, I don't get a rejected or error message, it just seems to drop.

What is bizarre about this is that when using the url to get to the teamspeak server I am hosting in the same little DMZ virtual environment, you can hit the teamspeak server that is running on a Linux server os. So DNS is resolving correctly, pinging the url returns the right ip.

What doesn't work is simply browsing to the site. This lead me to wonder if there is a firewalld issue causing it to drop, but why I originally overlooked this option was that while hitting it inside the same environment I could still access the site.

So I tried adding the rule

Code: Select all

iptables -I INPUT -p tcp --destination-port 80 -j ACCEPT

and then

Code: Select all

firewall-cmd --zone=public --add-port=http/tcp

But this failed to provide results.

How could I go about better troubleshooting this issue?

[bertan]

AFAIK, if firewalld is enabled, iptables will have no effect. You have to use one or the other.

Also, with firewall-cmd rules, you have to put

Code: Select all

--permanent

if you want them to persist after reboot then do a

Code: Select all

--reload

to make them current.

Can you really do

Code: Select all

--add-port=http/tcp

? I thought it had to be either

Code: Select all

--add-service=http

or

Code: Select all

--add-port=80/tcp

, but not a mixture of both.

A good tool for finding out where packets are being dropped is wireshark.