1

I have two Ubuntu servers with each having their own ip addresses.

Let's call them server1 and server2, having respectively ip 1.1.1.1 and 2.2.2.2

I have a nginx running on server2. The sole purpose I want server1 to have is to redirect all incoming http (so port 80) requests to server2 without clients noticing that their request is being redirected.

I tried the following command on server1:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 2.2.2.2

But when I enter 1.1.1.1 in my browser I get no respond: the page keeps trying to load without giving any message or error message (I get a time-out after 2-3 mins).

But when I do remove the above iptables rule I immediately do get a "page not found error" when I enter 1.1.1.1 in my browser; so something is working but not as it should: when I enter 1.1.1.1 I want the html page to load that is hosted on 2.2.2.2

Because when i enter 2.2.2.2 in my browser I do see the webpage loaded.

Could anyone please help me with this? I am searching quite some time (on severfault & Google) on this now so that's why I ask.

Many thanks for reading my question!

Update: Thank you all for you information. Unfortunately I still get no response

I have the following iptables configuration:

root@ip-10-48-238-216:/home/ubuntu# sudo iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
root@ip-10-48-238-216:/home/ubuntu# sudo iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DNAT tcp -- anywhere anywhere tcp dpt:www to:2.2.2.2

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination

When i run tcpdump and do request via chrome to 1.1.1.1 i get the following

root@ip-10-48-238-216:/home/ubuntu# sudo tcpdump -i eth0 port 80 -vv
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
13:56:18.346625 IP (tos 0x0, ttl 52, id 12055, offset 0, flags [DF], proto TCP (6), length 60)
212-123-161-112.ip.telfort.nl.16386 > ip-10-48-238-216.eu-west-1.compute.internal.www: Flags [S], cksum 0xb398 (correct), seq 2639758575, win 5840, options [mss 1460,sackOK,TS val 1223672 ecr 0,nop,wscale 6], length 0
13:56:18.346662 IP (tos 0x0, ttl 51, id 12055, offset 0, flags [DF], proto TCP (6), length 60)
212-123-161-112.ip.telfort.nl.16386 > ww1dc1.shopreme.com.www: Flags [S], cksum 0x9ee0 (correct), seq 2639758575, win 5840, options [mss 1460,sackOK,TS val 1223672 ecr 0,nop,wscale 6], length 0
13:56:18.598747 IP (tos 0x0, ttl 52, id 10138, offset 0, flags [DF], proto TCP (6), length 60)
212-123-161-112.ip.telfort.nl.16387 > ip-10-48-238-216.eu-west-1.compute.internal.www: Flags [S], cksum 0xac40 (correct), seq 2645658541, win 5840, options [mss 1460,sackOK,TS val 1223735 ecr 0,nop,wscale 6], length 0
13:56:18.598777 IP (tos 0x0, ttl 51, id 10138, offset 0, flags [DF], proto TCP (6), length 60)
212-123-161-112.ip.telfort.nl.16387 > ww1dc1.shopreme.com.www: Flags [S], cksum 0x9788 (correct), seq 2645658541, win 5840, options [mss 1460,sackOK,TS val 1223735 ecr 0,nop,wscale 6], length 0
^C
4 packets captured
4 packets received by filter
0 packets dropped by kernel

the mentioned address relate to the following
212-123-161-112.ip.telfort.nl.16386 : my personal computer
ww1dc1.shopreme.com.www : dns of server2 (2.2.2.2)
ip-10-48-238-216.eu-west-1.compute.internal.www : amazon web services ec2 internal address of server1 (1.1.1.1)

However, the tcpdump log on server2 (2.2.2.2) stays empty and I get no response back in my browser.

I am able to ping from server1 to server2.
And net.ipv4.ip_forward is set to 1 and so is /proc/sys/net/ipv4/ip_forward
Could there be anything else that is missing?

Update2:

Server1 is an aws ec2 micro instance, it is attached to a elastic ip which I called 1.1.1.1. all the time. The micro server used to be a bigger ec2 server, but due to its high costs we are switching to dedicated hosting. But in our iPhone client we used a fixed ip address, namely the elastic ip mentioned above. The iPhone client uses REST services on the server. So we now use a micro server on that elastic IP that should redirect all requests to a vps from an other company (www.xlshosting.nl) which has a different subnet. I do not know functionality that can redirect an aws elastic ip to an external ip address, so that's why I try it with a micro instance + iptables. That vps is what I called server2 all the time with ip 2.2.2.2. So server1 and server2 are on a different subnet. Does this help you?

4 Answers 4

1

It sounds like you could have a routing problem. Check using tcpdump on both servers and pointing tcpdump with the -i option to the correct ethX device to check if packets are being sent through the right network device on server1 and these packets also arrive at server2.

tcpdump -i ethX host 1.1.1.1 and port 80

Could it be that the packets arrive at server2 but server2 doesn't know where to send the replies to? Does server2 have a correct default gateway configured?

Check it with

route -n
0

run

echo 1 > /proc/sys/net/ipv4/ip_forward

To make the change permanent, put the following in /etc/sysctl.conf

net.ipv4.ip_forward = 1
0

Your problem can be:

1- Routing problem: You need to check the following:

1.1- Routing is enabled on Server1 as suggested by Patrick. File /proc/sys/net/ipv4/ip_forward is set to 1.

1.2- Server2 is able to reach the requesting client. You can try pinging server2 2.2.2.2 from your client. You can add static route using route add command.

2- Firewall problem: You need to check that your firewall allows you to access the IP 2.2.2.2. You can for simplicity set firewall policy to accept all traffic (INPUT, OUTPUT, FORWARD).

3
  • Thank you all for your information. Unfortunately it is still not working. Could you please be so kind to have a look at my updated question? Feb 12, 2011 at 14:27
  • It seems that you have a problem setting up your network! Can you please tell us the IPs you are using and how you are connecting your servers and client? If you are using public IPs, you can convert them to private IPs. The IPs in the form 1.1.1.1 and 2.2.2.2 are not helpful. Use private IPs like: 192.168.0.1/24 and 192.192.168.0.2/24. This way I can know that they are in the same subnet.
    – Khaled
    Feb 12, 2011 at 15:44
  • Thanks for your reply again! I have updated my question in which I try to explain it. Does that help you? Feb 15, 2011 at 14:22
0

I have a few questions:

What is the purpose of your setup? Is server1 meant to be a firewall that proxies to server2 because you don't want server2 to be directly accessible by the net?

How are the two machines connected? Directly via an crossover or though a router or something else?

Have you tried running tcpdump on both interfaces of server1 as well as the interface on server2? Running all three at the same time during a request will give you a pretty good idea of where things are getting mucked up.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .