a discussion starter i hope.

a discussion starter i hope.

[alan barrow]

I have been using iptables-netfilter for a while and wish to clarify in
my mind for once how to do the following. 

Scenario: An iptables firewall has 2 interfaces, which are a public and
a private interface, for simpilicty's sake. Behind the firewall a
service runs which needs to be visible to the world at large in this
case let's start with an easy one http, on port 80. 

No problems so far :) 

Now behind the firewall are 2 separate servers, each running a web
service and each running on port 80. 

1) The question is, with only 1 real world address available to you,
what suggestions do you guy's have as to the configuration required to
make both web servers available on the Internet ? So that incoming port
80 request on the firewall public interface go to the correct server. 

2) The same as scenario 1) except you have 2 addresses available but
only one external NIC. 

3) Same as 2) except you have 2 NIC's. 

The reason for this is the following is that, i wish to understand if
there is a path to this result. I realise there are probably many way's
to skin this cat, and i have tried a few of them, some of you may
already be doing this, but in my experience there seem to be a lot of
pitfall's and consequently the issues i have faced seem to suggest the
following: 

Some think it's possible, Some don't, some wish it was possible, many
just say this way, others suggest that way, many just give up. 

All in all i would like to take this to the logical conclusion of
getting it working in multiple scenarios securely and effectively. 

yours a.r.b. 

RE: a discussion starter i hope.

[Nathan Cassano]

Hi Alan,
 
> Now behind the firewall are 2 separate servers, each running a web
> service and each running on port 80. 
> 
> 1) The question is, with only 1 real world address available to you,
> what suggestions do you guy's have as to the configuration required to
> make both web servers available on the Internet ? So that incoming
port
> 80 request on the firewall public interface go to the correct server. 


If you are solely interested in distributing http requests from a single
access point I would suggest running apache as a reverse proxy on your
firewall. This way http requests for different domains can be directed
to different internal (or external) web servers. Optionally this could
be done on layer 4 with DNAT, by rewriting the destination of packets
and perhaps adding a user level program to direct packets but I am less
knowledgeable about the implementation of such a setup.

Here is a simple example of a reverse proxy apache configuration.

<VirtualHost *:80>

 DocumentRoot "/usr/local/apache/htdocs/server.tld"
 ServerName public.server.tld

 # Rewrite URL to back-end server URL
 RewriteEngine on
 RewriteLog logs/proxy_rewrite
 RewriteLogLevel 0

 RewriteRule ^/(.*)$ http://www1.server.internal/$1 [P]

 # Reverse Proxy the requested URL

 ProxyRequests on
 ProxyVia on
 ProxyPassReverse / http://www1.server.internal/

</VirtualHost>

a discussion starter i hope.

[alan barrow]

[-- Attachment #1: Type: text/plain, Size: 1565 bytes --]

I have been using iptables-netfilter for a while and wish to clarify in
my mind for once how to do the following.

Scenario: An iptables firewall has 2 interfaces, which are a public and
a private interface, for simpilicty's sake. Behind the firewall a
service runs which needs to be visible to the world at large in this
case let's start with an easy one http, on port 80.

No problems so far :)

Now behind the firewall are 2 separate servers, each running a web
service and each running on port 80.

1) The question is, with only 1 real world address available to you,
what suggestions do you guy's have as to the configuration required to
make both web servers available on the Internet ? So that incoming port
80 request on the firewall public interface go to the correct server.

2) The same as scenario 1) except you have 2 addresses available but
only one external NIC.

3) Same as 2) except you have 2 NIC's.

The reason for this is the following is that, i wish to understand if
there is a path to this result. I realise there are probably many way's
to skin this cat, and i have tried a few of them, some of you may
already be doing this, but in my experience there seem to be a lot of
pitfall's and consequently the issues i have faced seem to suggest the
following:

Some think it's possible, Some don't, some wish it was possible, many
just say this way, others suggest that way, many just give up. 

All in all i would like to take this to the logical conclusion of
getting it working in multiple scenarios securely and effectively.

yours a.r.b. 



[-- Attachment #2: Type: text/html, Size: 1903 bytes --]

Re: a discussion starter i hope.

[Antony Stone]

On Thursday 09 May 2002 9:11 pm, alan barrow wrote:

> Now behind the firewall are 2 separate servers, each running a web
> service and each running on port 80.
>
> 1) The question is, with only 1 real world address available to you,
> what suggestions do you guy's have as to the configuration required to
> make both web servers available on the Internet ? So that incoming port
> 80 request on the firewall public interface go to the correct server.

Which is the "correct server" ?

Are the two identical, and you want to do some sort of load balancing, or are 
they different, in which case what is the answer to the question "which is 
the correct server for packets coming in to this address" ?

> 2) The same as scenario 1) except you have 2 addresses available but
> only one external NIC.

No problem here - apply both external addresses to the NIC, have two 
translation rules forwarding packets from ExtAddrA to IntAddrA and ExtAddrB 
to IntAddrB.

> 3) Same as 2) except you have 2 NIC's.

Easy.   Take out one NIC and do what I suggested for question 2 above.

 

Antony.