NetFilter
[Top] [All Lists]

Re: iptables: hide the real web server from users

To: Mail List - Netfilter <netfilter@lists.netfilter.org>
Subject: Re: iptables: hide the real web server from users
From: Pascal Hambourg <pascal.mail@plouf.fr.eu.org>
Date: Thu, 15 Feb 2007 11:55:20 +0100
Delivered-to: sp-com-lists@consult.net
Delivered-to: netfilter-list1@securepoint.com
In-reply-to: <45D32DD7.80006@riverviewtech.net>
List-archive: </pipermail/netfilter>
List-help: <mailto:netfilter-request@lists.netfilter.org?subject=help>
List-id: General discussion and user questions <netfilter.lists.netfilter.org>
List-post: <mailto:netfilter@lists.netfilter.org>
List-subscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=subscribe>
List-unsubscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=unsubscribe>
Organization: Plouf !
References: <354862.54159.qm@web33304.mail.mud.yahoo.com> <45D32DD7.80006@riverviewtech.net>
Sender: netfilter-bounces@lists.netfilter.org
User-agent: Mozilla Thunderbird 1.0.6 (Windows/20050716)
Hello,

Grant Taylor a écrit :
Tim Perton wrote:

I want my users to do a request like
http://a.b.c.d/1.php and then machine A to make the
same request to System B, get the results and send
them back to the user transparently.

Technically you can do what you are wanting to do. However there are a few caveats that you need to be aware of when doing such.

1)  System B will see System A as the connecting host, not the real client.

This can be avoided. See below.

2) If System B is not ""behind System A (as you have described it to not be) it will have to send the traffic back to System A which will then send the traffic back to the client.

This is the reason of the 1). In order for B to send replies to A, A has to SNAT the forwarded connection with its own IP address. Unless you set up some tunnel or VPN between A and B and use it for the forwarded connexions (in both direction, so it may involve some advanced routing on A for return traffic), making B virtually "behind" A.

client ---internet--- system A (NAT) ===tunnel=== system B (server)


<Prev in Thread] Current Thread [Next in Thread>