iptables to redir subdomain to certain ports

iptables to redir subdomain to certain ports

[Andras Izsof]

Hi,

I need to redirect certain subdomains to certain ports on the same
server and vice versa. The most important is, that the manoeuvre must
be transparent to the client, because most company firewalls only
allow www data on port 80. So if I use a dl.domain.com:81 link on my
page, then it will be inaccessible for the "firewalled ones".

So if a request comes in for www.domain.com, then I need that to be
redirected to port 80(apache), that's OK, but when dl.domain.com pops
in, then port 81(thttpd) would be the target. Can this be done with
iptables and if so how?

Long ago someone recommended an iptables package for me, which is
capable of this, but can't find anything about it :(.

Thanks
DF

Re: iptables to redir subdomain to certain ports

[Jan Engelhardt]

>
> So if a request comes in for www.domain.com, then I need that to be
> redirected to port 80(apache), that's OK, but when dl.domain.com pops
> in, then port 81(thttpd) would be the target. Can this be done with
> iptables and if so how?

Only if www.domain.com has a distinct ip address from dl.domain.com. If 
that does not hold true, use Apache's mod_rewrite magic, because then 
you are actually working on l7 rather than l3.


	-`J'
-- 

Re: iptables to redir subdomain to certain ports

[Grant Taylor]

On 01/13/07 10:11, Jan Engelhardt wrote:
> Only if www.domain.com has a distinct ip address from dl.domain.com. If 
> that does not hold true, use Apache's mod_rewrite magic, because then 
> you are actually working on l7 rather than l3.

I'm not sure that mod_rewrite by its self will provide that much help. 
If you use mod_proxy, possibly in conjunction with mod_rewrite, you can 
configure a virtual domain of Apache to be a reverse proxy.  Thus when a 
client connects to Apache on 80 asking for a virtual domain, Apache will 
then go and as thttpd for the contents on behalf of the client.  This 
will mean that the clients will never have to choose a different port. 
If you need help with such, email me directly as this is not really a 
Netfilter issue.


Regarding L7 filter, it may work, but you would have to make sure that 
the returning traffic was un-redirected.  If you do not un-redirect the 
traffic, there is a very good chance that clients will see returning 
traffic directly from the thttpd server on port 81, thus the clients 
firewall and / or client IP stack will stop the connection.



Grant. . . .