Running Moodle inside a firewall

Running Moodle inside a firewall

by Bill Burgos -
Number of replies: 7
Greetings,

I initially posted in the General Section, but now I think that this is an installation problem.

My server is behind a Redhat firewall. I have Apache using ProxyPass to direct all requests to in the internal server at IP 192.168.x.x. Using the config.php to identify the wwwroot to a proper top level domain and setting for a buggy referer to 'true', my setup went OK. I was able to add courses and instructors. No problem.

The problem occurs when I try to add a course module. When I add an assignment, for example, the source page for adding the assignment reads:
(snipped for brevity)

form name="form" method="post" action="http://192.168.0.1/moodle/course/mod.php

On an internal network, when I click on 'Save changes', I get redirected to the login page. On the Internet, the browser tries to access a non-existant internal IP address with an eventual 'time out' or 'not found'.

I am not sure why the action refers to the inside IP for this instance only. I looked at /course/mod.php, but I don't have much of a clue how to change the settings to get the form to post using '$CFG->wwwroot' configuration.

From what I see, I can try to:

1. change some of the Apache settings to rewrite or redirect the headings.

2. change a configuration in the /course/mod.php file to force the post to use the TLD specified in the wwwroot config. Or use a relative address as in other post commands in the software.

I would really like some help on this as I am at a complete loss and not much of an expert.

Firewall:

Redhat 6.2 w/ Apache/1.3.20

Inside server:

Mandrake 8.2 w/ Apache/1.3.23

PHP Version 4.3.1

Much thanks in advance,

Bill
Average of ratings: -
In reply to Bill Burgos

Re: Running Moodle inside a firewall

by Martin Dougiamas -
Picture of Core developers Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers
The key thing here is when Moodle gets the server name from the function qualified_me() in lib/weblib.php.

It gets this from server environment variables HTTP_HOST, or SERVER_NAME if it can't find HTTP_HOST.

So it looks like an Apache configuration problem, perhaps you need to set up a virtual server for the external address, or change the default host to be the external address.

This problem will probably cease to exist when I review all the referer stuff in a future version.
Average of ratings: -
In reply to Martin Dougiamas

Re: Running Moodle inside a firewall

by Bill Burgos -
Martin,

Thanks for your reply. I know that you are busy at this time and I appreciate your response.

My phpinfo.php file does indeed show the HTTP_HOST as the internal IP. However, the SERVER_NAME gives me the TLD.

The hack that seems to work is as follows:
From the original lib/weblib.php


if (!empty($_SERVER["HTTP_HOST"])) {
$hostname = $_SERVER["HTTP_HOST"];
} else if (!empty($_ENV["HTTP_HOST"])) {
$hostname = $_ENV["HTTP_HOST"];
} else if (!empty($_ENV["SERVER_NAME"])) {
$hostname = $_ENV["SERVER_NAME"];
} else {
notify("Warning: could not find the name of this server!");
return false;


I changed the order or enviornment variables to:


if (!empty($_SERVER["SERVER_NAME"])) {
$hostname = $_SERVER["SERVER_NAME"];
} else
if (!empty($_ENV["SERVER_NAME"])) {
$hostname = $_ENV["SERVER_NAME"];
} else if (!empty($_ENV["HTTP_HOST"])) {
$hostname = $_ENV["HTTP_HOST"];
} else {
notify("Warning: could not find the name of this server!");
return false;


This forces the SERVER_NAME to be used first. The rest seems to work for me now.

I am not sure of any pitfalls of this change, but at least I can access from the Internet.

Thanks again for your direction and I hope this helps.

Bill
Average of ratings: -
In reply to Bill Burgos

Re: Running Moodle inside a firewall

by Martin Dougiamas -
Picture of Core developers Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers
I was moodling on something completely unrelated (reading a book on ethnography actually), but had a bit a brain flash about running Moodle in a firewall situation where you want people to access the same server as two different IPs (inside and outside).

I think the easiest solution is to run two separate copies of Moodle that share the same database! smile This way they will use different config.php info but will share everything else. Wish I'd thought of this before!

Just make sure the Moodle installations are exactly the same version, otherwise things could get messy.
Average of ratings: -
In reply to Martin Dougiamas

Re: Running Moodle inside a firewall

by Greg Barnett -
You can probably even use the same config.php.

In addition to the database, you will also have to make sure that the moodle data directory is shared.

Probably the easiest way to set this up would be to have a machine with two (or more) ip addresses, and set up virtual hosts under apache, both with the same document_root.

I use the same config.php on 2 test servers, and the production server. Using a few variables, config.php can be rather flexible.

$CFG->wwwroot = "http://{$_SERVER['HTTP_HOST']}/moodle";

$CFG->dirroot = "{$_SERVER['DOCUMENT_ROOT']}/moodle";
Average of ratings: -
In reply to Bill Burgos

Re: Running Moodle inside a firewall

by Petri Asikainen -
Other solution what I have been using is to use two different nameservers. (or if dns-server supports "splitted horizon" and can be configured return different answers for different hosts.)

Our internal user uses name server what returns real private addresses for servers. Also out internal servers are using internal dns. (Internal server is forwarding queries ty public server if needed.)

Internet users outside firewall are using our public dns-server what returns public address for servers. Address is then NATed of firewall.

And this works for all other services too.


Petri
Average of ratings: -
In reply to Petri Asikainen

Re: Running Moodle inside a firewall

by James Miller -
Petri,

Do you use Apache? Do you setup separate virtual hosts for the separate CNAME references?
Average of ratings: -
In reply to James Miller

Re: Running Moodle inside a firewall

by Petri Asikainen -
Yes, I'm using virtual hosts.

www.xxxxxxx.xxx
archive.xxxxxxx.xxx
resourses.xxxxxxx.xxx

all running in same ip-address.

Or did you mean something else,

Petri

Average of ratings: -