Gentoo Archives: gentoo-user

From: kashani <kashani-list@××××××××.net>
To: gentoo-user@l.g.o
Subject: Re: [gentoo-user] OT: iptables w/ 2 web servers
Date: Wed, 23 Sep 2009 21:49:30
In Reply to: [gentoo-user] OT: iptables w/ 2 web servers by James
1 James wrote:
2 > Hello,
3 >
4 > I have one static IP with DNS (primary and secondary)
5 > performed by my isp. I'm setting up a second web server
6 > with a different domain name. It is setup already by the ISP
7 > for DNS. Could someone post
8 > some simple iptable examples of how to route 2 different
9 > web server traffic streams to 2 different machines?
10 >
11 > Both are inside the same DMZ....2 different machines
12 > with different (NAT) IP addresses.
13 >
14 > Right now, all port 80 traffic is auto forwarded to
15 > a single NAT address on the firewall. Simple. Now I have
16 > to figure out how to forward different web traffic streams
17 > to 2 different NAT ip addresses, each on a different ip
18 > address and a different machine.
19 >
20 > I do not want to put the sites on the same machine, for a variety
21 > of reasons, beside one machine moves in a few months to a
22 > different physical location (and network numbers).
23 >
24 > Suggestions or a good book for example would be keen.
25 > I use raw IPtables/netfilter on the firewall. All servers
26 > are gentoo.
28 I'm not sure it's possible via firewall rules because they are
29 operating at the IP level and you'd really need to be doing deep looks
30 into the packets to read the http request headers in order to figure out
31 which server should be getting the connection.
32 The simplest solution is to run a reverse proxy on your firewall that
33 actually accepts the http connection, reads the http request, and then
34 forwards it on to the correct web server. You can do this in apache via
35 proxypass, Squid which is your most powerful and flexible option, ngnix,
36 lighttpd, or Varnish.
37 There are some security concerns with this type of setup, ie running
38 daemons open to the public on your firewall, reverse proxies need to be
39 locked down, hard to do IP based restrictions on the webserver, etc.
41 kashani