Re: iptables: hide the real web server from users

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello,

Grant Taylor a écrit :
Tim Perton wrote:

I want my users to do a request like
http://a.b.c.d/1.php and then machine A to make the
same request to System B, get the results and send
them back to the user transparently.

Technically you can do what you are wanting to do. However there are a few caveats that you need to be aware of when doing such.

1)  System B will see System A as the connecting host, not the real client.

This can be avoided. See below.

2) If System B is not ""behind System A (as you have described it to not be) it will have to send the traffic back to System A which will then send the traffic back to the client.

This is the reason of the 1). In order for B to send replies to A, A has to SNAT the forwarded connection with its own IP address. Unless you set up some tunnel or VPN between A and B and use it for the forwarded connexions (in both direction, so it may involve some advanced routing on A for return traffic), making B virtually "behind" A.

client ---internet--- system A (NAT) ===tunnel=== system B (server)



[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux