Iptables and vserver

Iptables and vserver

[Werner Schalk]

Hi,

I am currently facing a chicken-egg kinda problem and I was wondering whether 
you guys would be able to help me on that one. My setup is as follows:

Inet -> Host a.b.c.d (providing SSH, HTTP and DNS services) -> several 
VServers, 10.0.1.x (all providing SSH and HTTP as well)

So set up PRE- and POSTROUTING rules and I was able to transparently access 
the 10.0.1.x network. However of course I am not able to access the SSH and 
HTTP servers on the host itself anymore because iptables can not 
differentiate between the SSH and HTTP server provided by my host with the 
(one and only) public IP address and those servers provided by the Vserver 
the host also acts as a DNS server for. Can anybody point me to feasable 
solutions to this problem because I don't want (or actually I simply can't) 
to use more than public IP address on the host. Anyone? Might that be 
possible with advanced routing maybe?

Thanks a lot.

Bye,
Werner

Re: Iptables and vserver

[Michael Tautschnig]

Hello,
>
> So set up PRE- and POSTROUTING rules and I was able to transparently access
> the 10.0.1.x network. However of course I am not able to access the SSH and
> HTTP servers on the host itself anymore because iptables can not
> differentiate between the SSH and HTTP server provided by my host with the
> (one and only) public IP address and those servers provided by the Vserver
> the host also acts as a DNS server for. Can anybody point me to feasable
> solutions to this problem because I don't want (or actually I simply can't)
> to use more than public IP address on the host. Anyone? Might that be
> possible with advanced routing maybe?
>

I don't think this would ever be possible with advanced routing or the 
like - how would the server know, whether you are trying to access the 
vserver or the router? But it could be easily one, if you just changed the 
ports of the ssh/http-daemons to, let's say, 23 and 81 ...

It could probably be done for http, though, if you are using different 
names for the instances provided by the vservers and the ones on the 
router using layer7-filter.

Regards,
Michael

Re: Iptables and vserver

[Sertys]

On Sun, 20 Mar 2005 17:34:27 +0100 (CET), Michael Tautschnig  
<michael.tautschnig@zt-consulting.com> wrote:

> Hello,
>>
>> So set up PRE- and POSTROUTING rules and I was able to transparently  
>> access
>> the 10.0.1.x network. However of course I am not able to access the SSH  
>> and
>> HTTP servers on the host itself anymore because iptables can not
>> differentiate between the SSH and HTTP server provided by my host with  
>> the
>> (one and only) public IP address and those servers provided by the  
>> Vserver
>> the host also acts as a DNS server for. Can anybody point me to feasable
>> solutions to this problem because I don't want (or actually I simply  
>> can't)
>> to use more than public IP address on the host. Anyone? Might that be
>> possible with advanced routing maybe?
>>
>
> I don't think this would ever be possible with advanced routing or the  
> like - how would the server know, whether you are trying to access the  
> vserver or the router? But it could be easily one, if you just changed  
> the ports of the ssh/http-daemons to, let's say, 23 and 81 ...
>
> It could probably be done for http, though, if you are using different  
> names for the instances provided by the vservers and the ones on the  
> router using layer7-filter.
>
> Regards,
> Michael

Indeed michael is right. It's stupid to have several IP's sharing a domain  
name and vice versa unless for service backup. Since you are vhosting you  
can split the traffic on http proto queries and redirect it. You may do  
that with squid for example, cause it talks http. NameVhosting is another  
solution, but then you just have to issue a redirect page from your  
main(the public one) server and cross your fingers the clients use HTTP1.1  
:) It's a bit harder, not to say impossible to redirect trafic different  
 from HTTP. SSH packets would come with destination a.b.c.d and not  
containt some headers like "I wanna reach vmachine2.a.b.c.d". Thus, get  
your services across different ports. 222,2222,22222 is easy to remember :)


-- 
www.supportivo.org

I can't stop myself checking for pigs in the outlets. Everybody thinks i'm  
a punk, cause of the hairstyle(220V).
end