Zabbixagent Behind Firewall (NAT) Untangle

[smad]

Hi,

I install Zabbix Server which is working fine to check my LAN Server.
The zabbix Server is the last version 1.6.4.

Now, I add the zabbix agent on the Web Server which is behind a Untangle Gateway System.
But it seems that the Server and the agent can't communicate.

Configuration
WebServer(10.0.0.1)-- (10.0.0.2)Untangle(192.168.1.1)-- (192.168.1.10)ZabbixServer

The Web server is Ubuntu, I install zabbix-agent from the package (aptitude)
The agent (version 1.4.2) is running :

zabbix    7424  0.0  0.0   4756   648 ?        SN   09:37   0:00 /usr/sbin/zabbix_agentd
zabbix    7425  0.0  0.0   4756  1124 ?        SN   09:37   0:00 /usr/sbin/zabbix_agentd
zabbix    7426  0.0  0.0   4756   876 ?        SN   09:37   0:00 /usr/sbin/zabbix_agentd
zabbix    7427  0.0  0.0   4756   876 ?        SN   09:37   0:00 /usr/sbin/zabbix_agentd
zabbix    7428  0.0  0.0   4756   876 ?        SN   09:37   0:00 /usr/sbin/zabbix_agentd
zabbix    7429  0.0  0.0   4816   892 ?        SN   09:37   0:00 /usr/sbin/zabbix_agentd

I can read on the log on the web server that the server is start but can't be link to the server.

  7424:20090526:093754 zabbix_agentd started. ZABBIX 1.4.2.
  7425:20090526:093754 zabbix_agentd collector started
  7426:20090526:093754 zabbix_agentd listener started
  7427:20090526:093754 zabbix_agentd listener started
  7428:20090526:093754 zabbix_agentd listener started
  7429:20090526:093754 zabbix_agentd active check started [localhost:10051]
  7429:20090526:093754 Getting list of active checks failed. Will retry after 60 seconds

I think the problem is comming from the config file.
I am not sure, what I should write for the server data.
The Untangle server is doing a NAT, so from the web server I can't ping 192.168.1.10.
I did a port 10051 transfert from the untangle box to the zabbix server.
so the telnet reply OK

administrator@WEBSERVER:~$ telnet 10.0.0.2 10051
Trying 10.0.0.2...
Connected to 10.0.0.2.
Escape character is '^]'.

config file on the web Server : /etc/zabbix/zabbix_agent.conf

Server=10.0.0.2,192.168.1.10

On the zabbix Server, I can read for the web Server (10.0.0.1) this message :
[CODE]
Got empty string from [10.0.0.1]. Assuming that agent dropped connection because of access permissions
[CODE]

I can ping the Web Server but I can't telenet on 10051

administrator@ZABBIXSERVER:~$ ping 10.0.0.1
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=63 time=0.323 ms
64 bytes from 10.0.0.1: icmp_seq=2 ttl=63 time=0.273 ms
administrator@ZABBIXSERVER:~$ telnet 10.0.0.1 10051
Trying 10.0.0.1...
telnet: Unable to connect to remote host: Connection refused

What did I forget to do, to get it right?

Thanks for your help and sorry for the long post, I tried to put all necessary information.

[Cray]

Well, I don't know about the Untangle Gateway System, but as far I can read :

- if you can ping the Webserver, but cannot communicate with the Zabbix agent because of access permissions, it means the IP packets's headers you're receiving on the Webserver don't match those expected by the Webserver's agent.

WebServer(10.0.0.1)<-- (10.0.0.2)Untangle(192.168.1.1)<-- (192.168.1.10)ZabbixServer

When the packet is received at the highlighted point (aka by the Webserver interface), if the Source IP / Originating IP does not match the IP referenced in /etc/zabbix/zabbix_agent.conf for the Zabbix Server, the agent will drop it.

By the way, are you sure you can specify more than one Zabbix server for the Server= parameter

[smad]

server= ????

Thanks for your reply.

I am not sure if I can use more than 1 IP for the Server, that was a test.


Still I don't know how to resolve it

if I just write 10.0.0.2 or 192.168.1.10, I have the same error messages.

?? Is there a solution ??

[Cray]

Can you use a packet sniffer / traffic analyser on your web server, to have a look at the packet received ?