Bas Verhoeven a écrit :
Assuming that the outbound server is the default gateway for the web
server and receives the return traffic, of course.
You'd be kinda screwed if that was not the case.
The webserver has its own gateway, and that's not the outer box.
Don't look further. Here is why it does not work.
Is there really no solution for this?
Use the outer box as a gateway, if it is in the same network. You do not
have to use it as the default gateway for all traffic but at least for
the HTTP return traffic. This could be done with iptables and advanced
routing on the web server, for instance using the source port 80 to MARK
packets or using CONNMARK/connmark.
You could try to use the NOTRACK target on the web server in order to
prevent the incoming SYN packets from creating a new connection, so the
replies could be SNATed. But I would not bet a euro-cent on such a dirty
method. If someone asks who suggested it, don't say it's me. ;-)
|