Can Port Forward on Windows XP But Not on Ubuntu

[OtagoHarbour]

I have a static IP address and have a PC that has dual booting with Windows XP and Unbuntu 11.04. I have a static IP address and have registered my domain name with 1and 1. I have set up my router to allow port forwarding through port 80 and have no trouble doing this with Windows XP. When I am running Win. XP, start WampServer and put WampServer on-line I can access my web site from anywhere, including wireless devices.

With Ubuntu, I put index.html and index.php in both /var/www and in a newly created directory /var/www/htdocs. I even did

iptables --flush

and rebooted the PC. I can access files in /var/www/ from computers on my LAN, but when I try to access my web site, even from a home computer, I get the following message.

 
The connection has timed out 
 
             The server at mywebsite.com is taking too long to 
 respond. 
                  The site could be temporarily unavailable or too 
 busy. Try again in a few moments. 
                  If you are unable to load any pages, check your 
 computer's network connection. 
                  If your computer or network is protected by a 
 firewall or proxy, make sure that Firefox is permitted to access the 
 Web.

I set my port forwarding on the router to
Web Server
TCP Any -> 80
TCP Any -> 443

I tried to get the web server running with the following steps.
$ cd /etc/apache2/sites-enabled
$ sudo vi 000-default
Under <Directory /var/www/>
changed "Allow Override None" to "Allow Override All"
$ sudo a2enmod rewrite
$ sudo /etc/init.d/apache2 restart
$ cd /var
$ sudo chown -R www-data www

Unfortunately, I still cannot access my web page, even from my home computers, when the server is running Ubuntu.

The internal IP address seems to be assigned by the router and is 192.168.1.6 whether I boot in Win XP or Ubuntu. I can communicate with another computer on the LAN using that IP address. I can also ping to the IP address (192.168.1.6) of the web server, and also to the web site name, from any computer on my home network. That's actually progress since I was not able to do that, from the PC connected to the router by wireless, before I made the changes outlined above. However, I cannot connect by putting the web site name or 192.168.1.2 in the URL box on FireFox. I can open a web page at 127.0.0.1

I tried

 $ ssh 192.168.1.6

from another PC on the LAN and got

 
ssh: connect to host 192.168.1.6 port 22: Connection timed out

I tried using nmapfe. to see if I can open any ports. It said that all ports were filtered. None were "open" or "closed".
The filtering could have been from the other linux machine on which I ran nmapfe.

I tried uncommenting these in the AddType section of your httpd.conf.

AddType application/x-httpd-php .phtml 
AddType application/x-httpd-php .php 
AddType application/x-httpd-php-source .phps

and added

DirectoryIndex index.html index.phtml index.php index.phps

and restarted the PC. Still no luck.

When I installed LAMP, the The PHP info is as follows.

     
System     Linux WebLayer 2.6.38-12-generic #51-Ubuntu SMP Wed Sep 28 14:25:20 UTC 2011 i686 
Build Date     Oct 13 2011 21:55:18 Server API     
Apache 2.0 Handler Virtual Directory Support     
disabled Configuration File (php.ini) Path     /etc/php5/apache2 
Loaded Configuration File     /etc/php5/apache2/php.ini 
Scan this dir for additional .ini files     /etc/php5/apache2/conf.d 
Additional .ini files parsed     /etc/php5/apache2/conf.d/gd.ini, /etc/php5/apache2/conf.d/mcrypt.ini, /etc/php5/apache2/conf.d/mysql.ini, /etc/php5/apache2/conf.d/mysqli.ini, /etc/php5/apache2/conf.d/pdo.ini, /etc/php5/apache2/conf.d/pdo_mysql.ini 
PHP API     20090626 
PHP Extension     20090626 
Zend Extension     220090626 Zend 
Extension Build     API220090626,NTS 
PHP Extension Build     API20090626,NTS 
Debug Build     no 
Thread Safety     disabled 
Zend Memory Manager     enabled 
Zend Multibyte Support     disabled 
IPv6 Support     enabled 
Registered PHP Streams     https, ftps, compress.zlib, compress.bzip2, php, file, glob, data, http, ftp, phar, zip 
Registered Stream Socket Transports     tcp, udp, unix, udg, ssl, sslv3, sslv2, tls 
Registered Stream Filters     zlib.*, bzip2.*, convert.iconv.*, string.rot13, string.toupper, string.tolower, string.strip_tags, convert.*, consumed, dechunk, mcrypt.*, mdecrypt.*

The Apache handler info. is as follows.

Apache Version     Apache/2.2.17 (Ubuntu) 
Apache API Version     20051115 
Server Administrator     webmaster@localhost 
Hostname:Port     127.0.1.1:80 User/Group     www-data(33)/33 
Max Requests     Per Child: 0 - Keep Alive: on - Max Per Connection: 100 
Timeouts     Connection: 300 - Keep-Alive: 15 
Virtual Server     Yes 
Server Root     /etc/apache2 
Loaded Modules     core mod_log_config mod_logio prefork http_core mod_so mod_alias mod_auth_basic mod_authn_file mod_authz_default mod_authz_groupfile mod_authz_host mod_authz_user mod_autoindex mod_cgi mod_deflate mod_dir mod_env mod_mime mod_negotiation mod_php5 mod_reqtimeout mod_setenvif mod_status

The Apache environment info. is as follows.

HTTP_HOST     192.168.X.X 
HTTP_USER_AGENT     Mozilla/5.0 (X11; Linux i686; rv:7.0.1) Gecko/20100101 Firefox/7.0.1 
HTTP_ACCEPT     text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 
HTTP_ACCEPT_LANGUAGE     en-us,en;q=0.5 
HTTP_ACCEPT_ENCODING     gzip, deflate 
HTTP_ACCEPT_CHARSET     ISO-8859-1,utf-8;q=0.7,*;q=0.7 
HTTP_CONNECTION     keep-alive 
PATH     /usr/local/bin:/usr/bin:/bin 
SERVER_SIGNATURE     <address>Apache/2.2.17 (Ubuntu) Server at 192.168.1.3 Port 80</address> 
SERVER_SOFTWARE     Apache/2.2.17 (Ubuntu) 
SERVER_NAME     192.168.X.X 
SERVER_ADDR     192.168.X.X 
SERVER_PORT     80 
REMOTE_ADDR     192.168.X.X 
DOCUMENT_ROOT     /var/www 
SERVER_ADMIN     webmaster@localhost 
SCRIPT_FILENAME     /var/www/index.php 
REMOTE_PORT     47780 
GATEWAY_INTERFACE     CGI/1.1 
SERVER_PROTOCOL     HTTP/1.1 
REQUEST_METHOD     GET 
QUERY_STRING     no value 
REQUEST_URI     /index.php 
SCRIPT_NAME     /index.php

I've Xed out the NAT details for security.

I got my ip address from

http://myipaddress.com/show-my-ip-address/.

Let the resulting IP address be 12.34.567.89. I tried


http://12.34.567.89/htdocs/index.php

http://12.34.567.89/htdocs/index.html

http://12.34.567.89/index.html

All to no avail. I got the message
[code]
The connection has timed out.
The server at 12.34.567.89 is taking too long to respond
[\code]

although I had no problems pinging to 12.34.567.89.

I had gone through and made the following changes to ownership.

     
root@WebLayer:/var/www# cp index.html htdocs 
root@WebLayer:/var/www# chown www-data htdocs 
root@WebLayer:/var/www# chown www-data htdocs/* 
root@WebLayer:/var/www# chown www-data index.html 
root@WebLayer:/var/www# chown www-data index.php

before I tried the above calls.

When I try to load the php file from the browser, I get the following from the Apache access error logs.

[Sun Nov 13 12:23:26 2011] [error] [client 192.168.1.3] PHP Warning:  session_start(): open(/var/lib/php5/sess_slagobe4pt5f0j4e6lkgmamq11, O_RDWR) failed: Permission denied (13) in /var/www/index.php on line 23 
[Sun Nov 13 12:23:26 2011] [error] [client 192.168.1.3] PHP Warning:  Unknown: open(/var/lib/php5/sess_slagobe4pt5f0j4e6lkgmamq11, O_RDWR) failed: Permission denied (13) in Unknown on line 0 
[Sun Nov 13 12:23:26 2011] [error] [client 192.168.1.3] PHP Warning:  Unknown: Failed to write session data (files). Please verify that the current setting of session.save_path is correct (/var/lib/php5) in Unknown on line 0 
[Sun Nov 13 12:23:27 2011] [error] [client 192.168.1.3] File does not exist: /var/www/192.168.1.2, referer: http://192.168.1.3/index.php 
[Sun Nov 13 12:23:28 2011] [error] [client 192.168.1.3] File does not exist: /var/www/favicon.ico 
[Sun Nov 13 12:23:28 2011] [error] [client 192.168.1.3] File does not exist: /var/www/favicon.ico

Any assistance would be greatly appreciated,
Peter.

[redhead]

Let me get the issue here clear.
Your internal IP of the machine is 192.198.1.6, your external IP to the router is 12.34.567.89, you are experiencing problems when connecting to the machine on either 192.168.1.6 or 12.34.567.89, from your internal net?
You are experiencing problems when trying to connect on 12.34.567.89 from an external machine?
- This includes ssh aswell as http?

First of, let me tell you the IP 12.34.567.89 is invalid, but I see you're using it just as an example.

Have you tried to allow incomming connections in the firewall?
ie: iptables -I INPUT -i eth0 -p tcp --dport 80 -j ACCEPT
(assuming eth0 is your NIC)

Have you tried to open the firewall to anything from anywhere?
ie: iptables -P INPUT ACCEPT

Have you investigated what the actual iptables rules are?
ie: iptables -L INPUT -v

Have you investigated if your apache server is actualy listening on the correct port?
ie as root: netstat -lnp|grep 80
- should yield something like: tcp6 0 0 :::80 :::* LISTEN 2477/apache2

Have you made sure the activated default for your apache server is listening for connections to you IP?

Are you sure you're running an ssh server on the machine, openssh-server is installed and configured to listen on port 22?
ei: ssh localhost
again with netstat ie: netstat -lnp |grep 22

[OtagoHarbour]

Thank you very much for your reply.

- This includes ssh aswell as http?

Yes. I tried

$ ssh localhost

and got

ssh: connect to host localhost port 22: Connection refused

I then tried

$ ssh MyDomainName.com

and got

ssh: connect to host MyDomainName.com port 22: Connection refused

I will try the other thing you suggested and will reply later tonight.

Thanks again,
Peter.

[OtagoHarbour]

iptables -I INPUT -i eth0 -p tcp --dport 80 -j ACCEPT

That worked!!! I am finally able to deploy my home page to the Internet from Ubuntu. Thank you so much! I have been through 4 forums and a newsgroup and everyone eventually gave up. This is the first time it has worked.

The remaining issues are.
1/ Do I now need to tighten the firewall up for security?
2/ I have two PC servers: a web server and an application server. The home/index page is a PHP file on the web server which is connected to the Internet. The iptables on the application server is set so that the application server can only talk to the web server. The links on the index.php file all link to files on the application server. The links work fine when I am trying to link from the web server but not when I am trying to link from somewhere else. I do not want to open the application server up so anyone can access it but I do want those links to show up when anyone clicks on them. What would be the best way to do this.

One thing that I should point is that, while I can access my index page from another PC, ssh still gets a connection refused message.

Thanks again,
Peter.

[redhead]

1) No, it seems the default rule on the INPUT chain is set to DROP, thus you need to specify every port you want to use as a jump (-j) to the ACCEPT rule.
This will also solve your problem with ssh, just use port 22 in the line that worked for your web access, aswell with port 443 when concerning https requests.

2) This is somewhat different, you either need a proxy facility on your webserver to access those links through, or you need to NFS mount the apropriate locations on the application server from your web server, and access the links directly as a local link on the webserver.

As you describe that access, it will be something like, if webserver has IP 192.168.1.6 and appserver has IP 192.168.1.7, the links from your index page links to http://192.168.1.7/localtion/file or something like \\appserver\location\file this will work from your webserver (localy) since the access on the appserver is done through the internal 192.168.1.6 IP which is recognised from the appserver as a trusted IP, when accessing through the internet IP your client will say 192.168.1.7 is a local IP and cant be accessed directly over the internet, and if it could, your router/appserver will say the client IP (unknown but lets call it 130.225.96.225) is untrusted since it is connecting to an unknown port (in case of \\appserver\ from the router point of view) and from an IP-range which isnt within trusted segment (130.225.96.225 when looking at it from the appserver)