Subject: Re: MOD SSL over NAT

From: "Jim Lee" <[email-masked]>
Date: Sun, 27 Jan 2002 17:48:40 +0000

Response to Response:
Yes, the Firewall is configured to allow port 443.

In fact we are able to reach our web server from outside(internet) by typing 
in the following url.

http://www.website.com:443

But the moment we try the following url, it fails

https://www.website.com

The same above steps works successfully from within out network(intranet) 
without any problems. Both http and https work fine.

Any clues would be higly appreciated.

Original Posting:
On Sat, 2002-01-26 at 07:26, Jim Lee wrote:
We have an apache server with mod_ssl.
The SSL works fine within our network(intranet).
But for internet users, who access the apache server over NAT, the SSL does 
not work.

Response to Posting:
are you sure your nat setup is allowing traffic on port 443 (or whatever
port your ssl is running on)? try telneting to port 443 on the external
interface from someplace outside the firewall; if you can't you need to
reconfigure your firewall..
-jon

_________________________________________________________________
Chat with friends online, try MSN Messenger: http://messenger.msn.com

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Eli Marmor <[email-masked]>
Date: Sun, 27 Jan 2002 22:53:20 +0200

> reconfigure your firewall..

I had the same problem, and it resolved when I added an appropriate
iptables rule with the flags:

	-p tcp	--tcp-flags SYN,RST SYN	-j TCPMSS --clamp-mss-to-pmtu

I was told to add this rule by others who had the same problem too with
SSL connections.

I can't promise you that the problem is the same, nor that such a rule
will end your troubles (and I even don't know if your firewall is based
on iptables); I just tell from my experience.

By the way: If this is the cuase of the problem, then most of the
problems will be with SSL, but not only: a lack of such a rule, when
there are conflicting MTU's, may have other effects.

-- 
Eli Marmor
[email-masked]
CTO, Founder
Netmask (El-Mar) Internet Technologies Ltd.
__________________________________________________________
Tel.:   +972-9-766-1020          8 Yad-Harutzim St.
Fax.:   +972-9-766-1314          P.O.B. 7004
Mobile: +972-50-23-7338          Kfar-Saba 44641, Israel
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Glen Mehn <[email-masked]>
Date: Sun, 27 Jan 2002 11:42:47 -0800

you will need separate VirtualHost sections for both port 80 and port 443:

example (not real):

NameVirtualHost 10.10.10.10

<VirtualHost 10.10.10.10:443>
Servername my.server.com
DocumentRoot /path/to/docs
	<IfModule SSL)
	SSLEngine On
	SSLCertificateFile /path/to/crt
	(other ssl stuff)
	</IfModule>
</VirtualHost

<VirtualHost 10.10.10.10:80>
ServerName my.server.com
DocumentRoot /path/to/htdocs
ServerAdmin [email-masked]
(etc...)
</VirtualHost>

On Sun, Jan 27, 2002 at 05:48:40PM +0000, Jim Lee wrote:
> In fact we are able to reach our web server from outside(internet) by 
> typing in the following url.
> 

-- 
Glen S Mehn
Lead Systems Administrator		SquareTrade, Inc
[email-masked]	Building Trust in Transactions (sm)
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]