3

I'm hoping someone can help me with this configuration. I already have a working setup where a Linux box is acting as a router just doing port forwarding for public IP's. These are all public IP's btw.

HOST_x - Can be any host with public IP. (ex: x.x.x.x)

MY_LINUX - Using IPtables just doing port forwarding for public IP's. (Fixed IP, ex: 2.2.2.2)

SERVER - Web server having public IP address. (Fixed IP, ex. 3.3.3.3)

PORT - (TCP PORT = 80)

Here's the config on MY_LINUX:

iptables -t nat -A PREROUTING -p tcp -d 2.2.2.2 --dport 80 -j DNAT --to-destination 3.3.3.3:80 iptables -t nat -A POSTROUTING -p tcp -d 3.3.3.3 --dport 80 -j MASQUERADE

The configuration above works. When HOST_x types in 2.2.2.2 on the browser it gets the webpage from 3.3.3.3.

The only issue I have here is that the destination SERVER (3.3.3.3) sees the request coming from MY_LINUX (2.2.2.2), what I want to see is the original IP of the requesting HOST_x (x.x.x.x).

I would appreciate any suggestions, thank you.

2 Answers 2

3

I'd say this is not possible at the Layer-3 level. HOST_x is expecting remaining packets to come from the host where it initiated the connection MY_LINUX. If SERVER would suddenly get in the middle of the TCP handshake and reply, HOST_x would just ignore those packets.

Since HOST_x and SERVER have direct connectivity, I think it'd be better to move this routing scheme to the application layer and implement HTTP redirects. Then HOST_x opens a connection directly to the end point.

2
  • This would only be possible if MY_LINUX is the default gateway for SERVER.
    – mgorven
    Feb 13, 2013 at 18:42
  • @gtirloni - that's what I thought as well, thanks for clarifying.
    – halflogic
    Feb 13, 2013 at 19:29
0

You can do this if you have access to the webservers (or their gateway), too. The only solution that comes to my mind is a tunnel between router and webserver. Then the webserver (gateway) can send all reply packets to the router without having to adjust the destination address. If that is an option for you then I am going to have a look at the details.

1
  • Thanks unfortunately I don't have access to the destination servers. I only have access to MY_LINUX that only does port forwarding, destination can be any tcp based service.
    – halflogic
    Feb 13, 2013 at 19:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .