🚀 go-pugleaf

Hi there,

I've recently set up an OpenBSD 2.8 / ipf to run as firewall. The
configuration is a standard 3-legged setup with the firewall protecting a
DMZ and an internal network. I'm using private addresses in both the DMZ
(172.16.0.0/16) and the internal network (192.168.0.0/16), with NAT taking
care of translating public to private addresses in the DMZ.

Now, if I point a browser _outside the firewall_ to the public address of a
webserver residing in the DMZ everything is just fine. No problem there.

However, if I point a browser _in the internal network_ to the public
address of a webserver residing in the DMZ I get a connection refused.
Pointing the browser to the private address of the same webserver loads the
webpage just fine.

So, what's the problem? Well, I want to be able to use the public address of
the webservers residing in the DMZ from the internal network. I know that a
split-DNS could probably do the trick, but that's not an option here.

I've messed a bit around with the "rdr" actions in ipnat.rules but without
any success. Could one perhaps use the "to" option of "pass"/"block" to
forward packets to the appropriate interface?

Someone must have been down this road before, so please help a newbie out!!!

Best regards,
K. Rasmussen