Re: iptables: hide the real web server from users

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Hello,

Grant Taylor a écrit :
> Tim Perton wrote:
> 
>> I want my users to do a request like
>> http://a.b.c.d/1.php and then machine A to make the
>> same request to System B, get the results and send
>> them back to the user transparently.
> 
> Technically you can do what you are wanting to do.  However there are a 
> few caveats that you need to be aware of when doing such.
> 
> 1)  System B will see System A as the connecting host, not the real client.

This can be avoided. See below.

> 2)  If System B is not ""behind System A (as you have described it to 
> not be) it will have to send the traffic back to System A which will 
> then send the traffic back to the client.

This is the reason of the 1). In order for B to send replies to A, A has 
to SNAT the forwarded connection with its own IP address. Unless you set 
up some tunnel or VPN between A and B and use it for the forwarded 
connexions (in both direction, so it may involve some advanced routing 
on A for return traffic), making B virtually "behind" A.

client ---internet--- system A (NAT) ===tunnel=== system B (server)