1

I've a server listening on port 10000. But this server is running only in a special case (then some third service is available). Otherwise the port is not listened. Is it possible to redirect the client to another port if 10000 is not listening?

I see two solutions: 1) insert/remove iptables rules on server start/stop, but since the server may be killed, it may not insert the correct iptable redirect rule before dieing.

2) make a permanent userspace rule that checks if the port is listening and redirects the packet if not listened.

How to do 2) ? Do someone have recipes for ipq?

May be someone can suggest me a better way?

It is something like fallback redirect: I'll have thousand of clients with different ports (10000-11000) and if their instance of server is not running, whey should be redirected to some page explaining why they don't have and instance connected.

2 Answers 2

1

Use the -m socket match.

See this webpage for some more explicit instructions: http://carnivore.it/2009/11/22/iptables_-_match_closed_ports

0
1

I think a better option is to use a load balancer such as haproxy. You can configure it to listen on many ports and use different back-end servers.

To implement the functionality of redirecting the user to a different port (or different server), you can use backup option in haproxy.

This is an oversimplified configuration for your front-end (clients) and back-end servers:

frontend my_clients 0.0.0.0:10000
        acl its_ok always_true
        use_backend my_backend if its_ok
        default_backend my_backend
backend my_backend
        balance source
        server  server1 IP:port other options...
        server  server2 IP:port other options...

As said here, you can use backup keyword. This means that backup server will be used only when there is no other non-backup server available.

This is used primarily for HTTP load balancing, but they say that it can be used for other tcp-based services.

1
  • Good idea, I thought about some ngnix or other proxy. Before accepting this solution I would like to see if any other ideas would come. May be iptables nf queue would be more simple?
    – PoltoS
    Mar 8, 2011 at 9:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .