On a new Windows SBS 2003 we have created the website in IIS.
If we try to access the website externally we get the following error:
HTTP Error 403.6 - Forbidden: IP address of the client has been rejected.
Internet Information Services (IIS)
If we try to access the website fron inside the network we get the
login page of the router.
Could you help please.
Regards,
Guido
Guido wrote on Wed, 10 Jan 2007 00:12:01 -0800:
> On a new Windows SBS 2003 we have created the website in IIS.
>
> If we try to access the website externally we get the following error:
> HTTP Error 403.6 - Forbidden: IP address of the client has been rejected.
> Internet Information Services (IIS)
Look at the website properties, someone has set IP restrictions to prevent
it being accessed. Possibly it's been restricted to prevent public access to
the site, or someone has set it up wrong (eg. denied a known range instead
of allowing it, or setting the site to deny all and only allow internal
addresses).
> If we try to access the website fron inside the network we get the
> login page of the router.
In order to access the site from inside the network you need to use it's
internal IP address, not the external one. As you can see, with your
particular router you just get the router login page (as you're requesting
an IP mapped to the outside interface of the router from the inside
interface), although I'd expect you to have gotten no response at all - what
make and model of router is that?
Dan
Dear Daniel,
The router is a Netgear FVS318.
To go to the website we just type www.wbsitename.com
The IP address in the website section of IIS is the LAN IP address of the
SBS Server.
Regards,
Guido
"Daniel Crichton" wrote:
> Guido wrote on Wed, 10 Jan 2007 00:12:01 -0800:
>
> > On a new Windows SBS 2003 we have created the website in IIS.
> >
> > If we try to access the website externally we get the following error:
> > HTTP Error 403.6 - Forbidden: IP address of the client has been rejected.
> > Internet Information Services (IIS)
>
> Look at the website properties, someone has set IP restrictions to prevent
> it being accessed. Possibly it's been restricted to prevent public access to
> the site, or someone has set it up wrong (eg. denied a known range instead
> of allowing it, or setting the site to deny all and only allow internal
> addresses).
>
> > If we try to access the website fron inside the network we get the
> > login page of the router.
>
> In order to access the site from inside the network you need to use it's
> internal IP address, not the external one. As you can see, with your
> particular router you just get the router login page (as you're requesting
> an IP mapped to the outside interface of the router from the inside
> interface), although I'd expect you to have gotten no response at all - what
> make and model of router is that?
>
> Dan
>
>
>
Dear Daniel,
I am sorry.
The correct model of the Router is
Netgear FVS338
Regards,
Guido
"Daniel Crichton" wrote:
> Guido wrote on Wed, 10 Jan 2007 00:12:01 -0800:
>
> > On a new Windows SBS 2003 we have created the website in IIS.
> >
> > If we try to access the website externally we get the following error:
> > HTTP Error 403.6 - Forbidden: IP address of the client has been rejected.
> > Internet Information Services (IIS)
>
> Look at the website properties, someone has set IP restrictions to prevent
> it being accessed. Possibly it's been restricted to prevent public access to
> the site, or someone has set it up wrong (eg. denied a known range instead
> of allowing it, or setting the site to deny all and only allow internal
> addresses).
>
> > If we try to access the website fron inside the network we get the
> > login page of the router.
>
> In order to access the site from inside the network you need to use it's
> internal IP address, not the external one. As you can see, with your
> particular router you just get the router login page (as you're requesting
> an IP mapped to the outside interface of the router from the inside
> interface), although I'd expect you to have gotten no response at all - what
> make and model of router is that?
>
> Dan
>
>
>
Guido wrote on Wed, 10 Jan 2007 11:59:02 -0800:
> Dear Daniel,
>
> I am sorry.
>
> The correct model of the Router is
>
> Netgear FVS338
I'll look at the manual later to see why it's showing the admin login, but
I'm assuming it's because you're using an external IP from an internal
machine that is mapped to the router. You will need to change the IP address
for www.wbsitename.com
to it's internal one for just your internal users - you can do this by using
a split DNS system (one DNS server for internal users, and a different one
for external users), or by editing the hosts file on all internal machines
(messy and awkward to maintain), by having all internal users use a proxy
server that handles the request (makes it easy to regulate access to the web
site internally, but has the problem of becoming another single point of
failure), or if you have a router/firewall between your internal users and
the DNS servers it may have a translation facility (for instance, the Cisco
PIX firewall I have here can be set to map external IPs from the public DNS
servers to internal IPs in the responses so that internal users are directed
to the correct IP).
What about the rest of my reply? Did you check the IP restrictions for the
site in IIS Admin?
Dan
Dear Daniel,
Thank you for your response.
I bit more information for you.
I can ping both the IP address of the SBS Server and the website.
Regards,
Guido
"Daniel Crichton" wrote:
> Guido wrote on Wed, 10 Jan 2007 11:59:02 -0800:
>
> > Dear Daniel,
> >
> > I am sorry.
> >
> > The correct model of the Router is
> >
> > Netgear FVS338
>
> I'll look at the manual later to see why it's showing the admin login, but
> I'm assuming it's because you're using an external IP from an internal
> machine that is mapped to the router. You will need to change the IP address
> for www.wbsitename.com
> to it's internal one for just your internal users - you can do this by using
> a split DNS system (one DNS server for internal users, and a different one
> for external users), or by editing the hosts file on all internal machines
> (messy and awkward to maintain), by having all internal users use a proxy
> server that handles the request (makes it easy to regulate access to the web
> site internally, but has the problem of becoming another single point of
> failure), or if you have a router/firewall between your internal users and
> the DNS servers it may have a translation facility (for instance, the Cisco
> PIX firewall I have here can be set to map external IPs from the public DNS
> servers to internal IPs in the responses so that internal users are directed
> to the correct IP).
>
> What about the rest of my reply? Did you check the IP restrictions for the
> site in IIS Admin?
>
> Dan
>
>
>
Guido wrote on Thu, 11 Jan 2007 19:45:00 -0800:
> Dear Daniel,
>
> Thank you for your response.
>
> I bit more information for you.
>
> I can ping both the IP address of the SBS Server and the website.
I'm afraid that doesn't answer my question. Be able to ping has no relation
to IP restrictions in IIS - the IP restriction kicks in when pages are
requested from IIS itself, ping just sends ICMP packets to the IP stack in
the operating system and never gets to IIS.
Until you can sort out the IP restrictions in IIS and the DNS resolution for
internal users it just isn't going to work.
Dan
Dear Dan,
There are no IP restrictions set in IIS Admin.
Regards,
Guido
"Daniel Crichton" wrote:
> Guido wrote on Thu, 11 Jan 2007 19:45:00 -0800:
>
> > Dear Daniel,
> >
> > Thank you for your response.
> >
> > I bit more information for you.
> >
> > I can ping both the IP address of the SBS Server and the website.
>
> I'm afraid that doesn't answer my question. Be able to ping has no relation
> to IP restrictions in IIS - the IP restriction kicks in when pages are
> requested from IIS itself, ping just sends ICMP packets to the IP stack in
> the operating system and never gets to IIS.
>
> Until you can sort out the IP restrictions in IIS and the DNS resolution for
> internal users it just isn't going to work.
>
> Dan
>
>
>
Guido wrote on Fri, 12 Jan 2007 12:55:00 -0800:
> Dear Dan,
>
> There are no IP restrictions set in IIS Admin.
Given the message you're seeing, there is a restriction somewhere - possibly
in another IIS on another machine, and the site you're looking at is not
where you expect it to be.
Dan