Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I currently have a site with a public and private IP running properly on an apache server A. There's also a new server B which will host the site ready to go with its own private IP.

Current Server - A:


New Server - B:


The above IPs are currently accessible form a web browser. In our firewall settings web interface:

# Current settings

# Suggested settings

PUBLIC_IP is currently pointing to PRIVATE_IP. I was told that pointing PUBLIC_IP to NEW_PRIVATE_IP should be sufficient to complete the server switch and the downtime will be a few seconds.

Has anyone done a similar task before? What am I missing from the above steps?


Here's what I see when I access PUBLIC_IP in Firefox after pointing to the NEW_PRIVATE_IP in the firewall settings:

Firefox can't find the server at PUBLIC_IP

After reverting to PRIVATE_IP in the firewall settings, the PUBLIC_IP is accessible through Firefox.

share|improve this question
up vote 3 down vote accepted

Has anyone done a similar task before?


What am I missing from the above steps?

Nothing... sounds good!

If you leave the old site running until the DNS change has propagated to all users of the new site then the downtime will be 0!

share|improve this answer
3 mappings had to be changed, one for the NAT, one for the http rule in the firewall and the https rule in the firewall. – Thierry Lam Apr 8 '11 at 17:26

If you're redirecting a domain to the new IP address, you may need to allow upto 24 hours for the DNS records to propagate. If you're physically migrating the IP address from one piece of hardware to another, you may need to use arping to update the mac address on the border routers so that the IP address can come up. If this is unrelated, can you confirm what you're doing in more detail?

Edit: Providing the content is mirrored on both sides, you won't experience any downtime.

share|improve this answer
The domain should still point to the PUBLIC_IP in both the current and new server. Will it still take up to 24 hours for the propagation to complete for changing the private ip that the public ip is pointing to? – Thierry Lam Apr 5 '11 at 19:39
This depends on DNS timeouts. I usually set mine to a 24-hours in my DNS settings, but it can be as little as 30 minutes. It also depends on the browser cache of your clients. – tjameson Apr 5 '11 at 19:45
As it's a firewall the DNS propagation issue isn't relative. Redirecting the public IP address to a new internal private IP address is instant. – Richard Apr 5 '11 at 19:46

Thierry, you seem to be using DNAT/ port forwarding from your firewall. Is that correct? If so, then you need to be careful because existing connections might be dropped if you simply change the rule. I'm not sure what happens to the NAT table for existing TCP connections after you change the firewall rule (and don't specify --state new). That said, my guess is that old connections are preserved in the NAT table, so things should work until those connections are closed.

So you might want to add a new public IP and make the switch using DNS, so you're sure that existing connections are not affected.

share|improve this answer
That sounds like a safe solution. After I get a new public IP and point it to the new private IP, will there be a downtime when I point the new public ip to the domain name? – Thierry Lam Apr 5 '11 at 20:02
No, but you should test the new public IP first to make sure it's setup correctly and your website is reachable, before switch the DNS entry. – Yves Junqueira Apr 6 '11 at 13:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.