Hello,
So set up PRE- and POSTROUTING rules and I was able to transparently access
the 10.0.1.x network. However of course I am not able to access the SSH and
HTTP servers on the host itself anymore because iptables can not
differentiate between the SSH and HTTP server provided by my host with the
(one and only) public IP address and those servers provided by the Vserver
the host also acts as a DNS server for. Can anybody point me to feasable
solutions to this problem because I don't want (or actually I simply can't)
to use more than public IP address on the host. Anyone? Might that be
possible with advanced routing maybe?
I don't think this would ever be possible with advanced routing or the like - how would the server know, whether you are trying to access the vserver or the router? But it could be easily one, if you just changed the ports of the ssh/http-daemons to, let's say, 23 and 81 ...
It could probably be done for http, though, if you are using different names for the instances provided by the vservers and the ones on the router using layer7-filter.
Regards, Michael
Indeed michael is right. It's stupid to have several IP's sharing a domain name and vice versa unless for service backup. Since you are vhosting you can split the traffic on http proto queries and redirect it. You may do that with squid for example, cause it talks http. NameVhosting is another solution, but then you just have to issue a redirect page from your main(the public one) server and cross your fingers the clients use HTTP1.1 :) It's a bit harder, not to say impossible to redirect trafic different from HTTP. SSH packets would come with destination a.b.c.d and not containt some headers like "I wanna reach vmachine2.a.b.c.d". Thus, get your services across different ports. 222,2222,22222 is easy to remember :)
-- www.supportivo.org
I can't stop myself checking for pigs in the outlets. Everybody thinks i'm a punk, cause of the hairstyle(220V).
end
