On Wednesday 30 June 2004 10:13 am, Askar Ali Khan wrote: > > iptables -A PREROUTING -t nat -p tcp --dport 80 -s a.b.c.d -j DNAT --to > > w.x.y.z > > may i have to replace w.x.y.z with the IP of domain or simply > www.abc.com will work? You can use www.abc.com, but you must remember that www.abc.com will be resolved to an IP address *at the time you enter the rule*, and the rule will then exist on your firewall with that IP address while the firewall is running. Therefore if www.abc.com always resolves to one IP address, it makes no difference whether you enter the rule by IP or name. If www.abc.com resolves to one IP address, but that address changes, your firewall wil continue to use the old IP address until you change it. If www.abc.com resolves to more than one IP address, only one will get entered into the rule if you specify the name (and you would need to use multiple rules if you specify by IP), and therefore only some of the packets sent to ww.abc.com would match the rule. > > If this is not what you want, and you do indeed need to do stuff at OSI > > layer 7, working on HTTP rather than TCP and IP, you should probably look > > into http://www.squid-cache.org > > we have firewall it redirect traffic to cache server running "squid" > > :) may i put this rule on firewall machine or the cache server ? If you want to use netfilter rules, put them on the firewall. If you want to do URL redirection and perhaps regular expression matching, or you want to make sure that www.abc.com always works in a rule, then use Squid (because that will do a DNS lookup of www.abc.com every time it sees it in a URL). Regards, Antony. -- There are only 10 types of people in the world: those who understand binary notation, and those who don't. Please reply to the list; please don't CC me.
