Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have installed varnish on my server and would like to test the configuration without affecting normal usage. I have apache listening on port 80 and varnish on port 8080. So, I want all requests from my IP a.b.c.d to pass through varnish and all the other IPs should be allowed to access apache normally.

I read somewhere that it is possible to use PREROUTING in Iptables to achieve this. Can some one please tell me how to do it? I have 2 sites hosted on the server, is it possible to configure this for just one domain?

Update
I tried the command, but it did not work

root@git:~# iptables -A PREROUTING -t nat -i venet0 -p tcp -s 117.201.192.67 --dport 80 -j REDIRECT --to-port 8000
root@git:~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
root@git:~# iptables -A PREROUTING -t nat -i venet0:0 -p tcp -s 117.201.192.67 --dport 80 -j REDIRECT --to-port 8000
Warning: weird character in interface `venet0:0' (No aliases, :, ! or *).
root@git:~# iptables -A PREROUTING -t nat -p tcp -s 117.201.192.67 --dport 80 -j REDIRECT --to-port 8000
root@git:~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

I am on a VPS and do not have an interface named eth0. /sbin/ifconfig lists lo, venet0, venet0:0, venet0:1 and venet0:2 only.

Update 2 - Inserting the rule at the beginning worked

iptables -t nat -I PREROUTING -p tcp -s 117.201.192.67  --dport 80 -j REDIRECT --to-port 8000

Is it possible to check the requested hostname too? I would like to redirect only requests for mydomainname.com

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

You can specify source address (or network) in an iptables redirect as follows:

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

The rules are read from top to bottom, and first match goes, so you might have to stick it in the right place.

share|improve this answer
    
I am new to iptables. How can I configure it to redirect only requests from the ipaddress a.b.c.d? –  Joyce Babu Apr 27 '11 at 9:59
1  
Add -s a.b.c.d to the rule. -s means source of the packet. –  Paweł Brodacki Apr 27 '11 at 10:07
1  
Use -I to insert the rule at the beginning of the chain. –  Iain Apr 27 '11 at 11:26
    
Thanks it worked. Is it better to add -i venet0? Also is it possible to check the requested hostname too? –  Joyce Babu Apr 27 '11 at 11:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.