From mboxrd@z Thu Jan 1 00:00:00 1970 From: alan barrow Subject: a discussion starter i hope. Date: 09 May 2002 21:11:01 +0100 Sender: netfilter-admin@lists.samba.org Message-ID: <1020975061.20151.16.camel@sarig.internal> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="=-v+G1OIkCBdd1oas7NFi4" Return-path: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.samba.org --=-v+G1OIkCBdd1oas7NFi4 Content-Type: text/plain Content-Transfer-Encoding: 7bit I have been using iptables-netfilter for a while and wish to clarify in my mind for once how to do the following. Scenario: An iptables firewall has 2 interfaces, which are a public and a private interface, for simpilicty's sake. Behind the firewall a service runs which needs to be visible to the world at large in this case let's start with an easy one http, on port 80. No problems so far :) Now behind the firewall are 2 separate servers, each running a web service and each running on port 80. 1) The question is, with only 1 real world address available to you, what suggestions do you guy's have as to the configuration required to make both web servers available on the Internet ? So that incoming port 80 request on the firewall public interface go to the correct server. 2) The same as scenario 1) except you have 2 addresses available but only one external NIC. 3) Same as 2) except you have 2 NIC's. The reason for this is the following is that, i wish to understand if there is a path to this result. I realise there are probably many way's to skin this cat, and i have tried a few of them, some of you may already be doing this, but in my experience there seem to be a lot of pitfall's and consequently the issues i have faced seem to suggest the following: Some think it's possible, Some don't, some wish it was possible, many just say this way, others suggest that way, many just give up. All in all i would like to take this to the logical conclusion of getting it working in multiple scenarios securely and effectively. yours a.r.b. --=-v+G1OIkCBdd1oas7NFi4 Content-Type: text/html; charset=utf-8 I have been using iptables-netfilter for a while and wish to clarify in my mind for once how to do the following.

Scenario: An iptables firewall has 2 interfaces, which are a public and a private interface, for simpilicty's sake. Behind the firewall a service runs which needs to be visible to the world at large in this case let's start with an easy one http, on port 80.

No problems so far :)

Now behind the firewall are 2 separate servers, each running a web service and each running on port 80.

1) The question is, with only 1 real world address available to you, what suggestions do you guy's have as to the configuration required to make both web servers available on the Internet ? So that incoming port 80 request on the firewall public interface go to the correct server.

2) The same as scenario 1) except you have 2 addresses available but only one external NIC.

3) Same as 2) except you have 2 NIC's.

The reason for this is the following is that, i wish to understand if there is a path to this result. I realise there are probably many way's to skin this cat, and i have tried a few of them, some of you may already be doing this, but in my experience there seem to be a lot of pitfall's and consequently the issues i have faced seem to suggest the following:

Some think it's possible, Some don't, some wish it was possible, many just say this way, others suggest that way, many just give up.

All in all i would like to take this to the logical conclusion of getting it working in multiple scenarios securely and effectively.

yours a.r.b.

--=-v+G1OIkCBdd1oas7NFi4-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: alan barrow Subject: a discussion starter i hope. Date: 09 May 2002 23:52:29 +0100 Sender: netfilter-admin@lists.samba.org Message-ID: <1020984749.22168.19.camel@sarig.internal> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org I have been using iptables-netfilter for a while and wish to clarify in my mind for once how to do the following. Scenario: An iptables firewall has 2 interfaces, which are a public and a private interface, for simpilicty's sake. Behind the firewall a service runs which needs to be visible to the world at large in this case let's start with an easy one http, on port 80. No problems so far :) Now behind the firewall are 2 separate servers, each running a web service and each running on port 80. 1) The question is, with only 1 real world address available to you, what suggestions do you guy's have as to the configuration required to make both web servers available on the Internet ? So that incoming port 80 request on the firewall public interface go to the correct server. 2) The same as scenario 1) except you have 2 addresses available but only one external NIC. 3) Same as 2) except you have 2 NIC's. The reason for this is the following is that, i wish to understand if there is a path to this result. I realise there are probably many way's to skin this cat, and i have tried a few of them, some of you may already be doing this, but in my experience there seem to be a lot of pitfall's and consequently the issues i have faced seem to suggest the following: Some think it's possible, Some don't, some wish it was possible, many just say this way, others suggest that way, many just give up. All in all i would like to take this to the logical conclusion of getting it working in multiple scenarios securely and effectively. yours a.r.b. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: a discussion starter i hope. Date: Thu, 13 Jun 2002 17:13:50 +0100 Sender: netfilter-admin@lists.samba.org Message-ID: <200206131614.RAA08245@slate.rockstone.co.uk> References: <1020975061.20151.16.camel@sarig.internal> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <1020975061.20151.16.camel@sarig.internal> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org On Thursday 09 May 2002 9:11 pm, alan barrow wrote: > Now behind the firewall are 2 separate servers, each running a web > service and each running on port 80. > > 1) The question is, with only 1 real world address available to you, > what suggestions do you guy's have as to the configuration required to > make both web servers available on the Internet ? So that incoming port > 80 request on the firewall public interface go to the correct server. Which is the "correct server" ? Are the two identical, and you want to do some sort of load balancing, or are they different, in which case what is the answer to the question "which is the correct server for packets coming in to this address" ? > 2) The same as scenario 1) except you have 2 addresses available but > only one external NIC. No problem here - apply both external addresses to the NIC, have two translation rules forwarding packets from ExtAddrA to IntAddrA and ExtAddrB to IntAddrB. > 3) Same as 2) except you have 2 NIC's. Easy. Take out one NIC and do what I suggested for question 2 above. Antony. From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Nathan Cassano" Subject: RE: a discussion starter i hope. Date: Thu, 13 Jun 2002 09:30:45 -0700 Sender: netfilter-admin@lists.samba.org Message-ID: <0b1a01c212f7$ab1b9990$2901a8c0@amos> References: <1020984749.22168.19.camel@sarig.internal> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1020984749.22168.19.camel@sarig.internal> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: 'alan barrow' , netfilter@lists.samba.org Hi Alan, > Now behind the firewall are 2 separate servers, each running a web > service and each running on port 80. > > 1) The question is, with only 1 real world address available to you, > what suggestions do you guy's have as to the configuration required to > make both web servers available on the Internet ? So that incoming port > 80 request on the firewall public interface go to the correct server. If you are solely interested in distributing http requests from a single access point I would suggest running apache as a reverse proxy on your firewall. This way http requests for different domains can be directed to different internal (or external) web servers. Optionally this could be done on layer 4 with DNAT, by rewriting the destination of packets and perhaps adding a user level program to direct packets but I am less knowledgeable about the implementation of such a setup. Here is a simple example of a reverse proxy apache configuration. DocumentRoot "/usr/local/apache/htdocs/server.tld" ServerName public.server.tld # Rewrite URL to back-end server URL RewriteEngine on RewriteLog logs/proxy_rewrite RewriteLogLevel 0 RewriteRule ^/(.*)$ http://www1.server.internal/$1 [P] # Reverse Proxy the requested URL ProxyRequests on ProxyVia on ProxyPassReverse / http://www1.server.internal/