Re: Iptables and vserver

[Sertys <sertys@supportivo.org>]

On Sun, 20 Mar 2005 17:34:27 +0100 (CET), Michael Tautschnig  
<michael.tautschnig@zt-consulting.com> wrote:

> Hello,
>>
>> So set up PRE- and POSTROUTING rules and I was able to transparently  
>> access
>> the 10.0.1.x network. However of course I am not able to access the SSH  
>> and
>> HTTP servers on the host itself anymore because iptables can not
>> differentiate between the SSH and HTTP server provided by my host with  
>> the
>> (one and only) public IP address and those servers provided by the  
>> Vserver
>> the host also acts as a DNS server for. Can anybody point me to feasable
>> solutions to this problem because I don't want (or actually I simply  
>> can't)
>> to use more than public IP address on the host. Anyone? Might that be
>> possible with advanced routing maybe?
>>
>
> I don't think this would ever be possible with advanced routing or the  
> like - how would the server know, whether you are trying to access the  
> vserver or the router? But it could be easily one, if you just changed  
> the ports of the ssh/http-daemons to, let's say, 23 and 81 ...
>
> It could probably be done for http, though, if you are using different  
> names for the instances provided by the vservers and the ones on the  
> router using layer7-filter.
>
> Regards,
> Michael

Indeed michael is right. It's stupid to have several IP's sharing a domain  
name and vice versa unless for service backup. Since you are vhosting you  
can split the traffic on http proto queries and redirect it. You may do  
that with squid for example, cause it talks http. NameVhosting is another  
solution, but then you just have to issue a redirect page from your  
main(the public one) server and cross your fingers the clients use HTTP1.1  
:) It's a bit harder, not to say impossible to redirect trafic different  
 from HTTP. SSH packets would come with destination a.b.c.d and not  
containt some headers like "I wanna reach vmachine2.a.b.c.d". Thus, get  
your services across different ports. 222,2222,22222 is easy to remember :)


-- 
www.supportivo.org

I can't stop myself checking for pigs in the outlets. Everybody thinks i'm  
a punk, cause of the hairstyle(220V).
end