Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a server in the office, with a local IP address (192.168.1.15). The server is connected to Internet, but doesn't have a real IP address (it's just a simple DSL connection). I have another server at rackspace.com, which has a real IP address and a domain name.

Now I want to make my HTTP website hosted locally to become available online, through the rackspace server. I think that I need to setup a VPN connection from local to public server and then setup a HTTP tunnel or something similar. Can you give a link to the documentation I need to read? It's Ubuntu in both servers.

share|improve this question
4  
Why not move your content from your development server to the hosted server rather than having one act like a long-distance proxy? –  Bart Silverstrim Jun 17 '11 at 1:33
    
What exactly are you trying to do here because the way you worded it makes no sense. If your going to host a website why not put it on the public facing box instead of tunneling it from you box at home. Additionally if you just want to host a site from your house without using some tunneling magic setup up dyndns.com. –  Wilshire Jun 17 '11 at 2:09
1  
I can't move my content for certain reasons. I'm interested to do exactly what is explained above, in the question. –  yegor256 Jun 17 '11 at 2:57
1  
this question doesn't make sense. trying to serve content from a webserver you can't put content on defeats the purpose of having a webserver. –  Jim B Jun 17 '11 at 3:34
1  
Although yegor has not named his motive, I could think of a handful valid reasons for not hosting the content itself in the datacentre instantly. –  the-wabbit Jun 17 '11 at 7:44

1 Answer 1

up vote 2 down vote accepted

You would need to set up a VPN tunneling connection. I would recommend using OpenVPN - it deals well with dynamic IP addresses and NAT, is secure, relatively easy to configure and has a package in Ubuntu which makes it a faster start. The ubuntu documentation site has a quickstart howto on configuring it. You would obviously need to set up the server part on your rackspace machine and the client part on your office machine.

After this is done and you have tested your connectivity, you would need something called a "reverse proxy setup" where a HTTP service running on your rackspace machine would forward all requests to your office machine webserver and hand the responses back out to the clients. HTTP proxy solutions like squid and popular web server software like apache or nginx support this mode of operation mainly used for load-balancing and caching by admins - but they will support your basic needs very well. If you want a fast setup with the least reading, I'd recommend going with nginx.

Edit: you have to consider the security implications of this setup as well. Do it wrong and you're inviting attackers to your internal network. As a general rule for the security concept, you would have to consider your 192.168.1.15 office server potentially harmful and make sure it can't wreak havoc when taken over by an attacker. Furthermore, you should make sure that your VPN connection does not allow anything but access to port 80 of your internal web server (typically by using iptables rules on your office server) - this way the potential rackspace server hacker would only be able to abuse nothing more but the web service.

Edit #2: technically, it is also possible use a simple port forwarding rule from your rackspace host, but this will have several disadvantages making it a poor choice. For one, you will not be able to do useful IP address logging at your web server as all packets will arrive with the source IP address from your rackspace host and having no further information about the request origin - reverse proxies work around that by adding an X-Forwarded-for (or similar) header to the requests which can be used for the logs. Additionally, you would end up directly exposing your internal webserver to "the evil net" thus significantly widening the attack surface.

share|improve this answer
    
+1 to achieve what you describe in your question this is correct. You need to establish a link between the two servers (e.g. openvpn), then you need to pass certain traffic from the webserver at rackspace to the webserver locally (e.g. mod_proxy in apache). This would technically work, however per the other comments routing internet facing traffic from a specialized server down a domestic dsl connection may not be the best option. –  Coops Jun 17 '11 at 8:06
1  
He is pretty set to it: I can't move my content for certain reasons. I suspect this would be either due to either a large set of dependencies which cannot be met at the public server easily (access to internal databases, file services or other internally-hosted resources) or due to data privacy protection rules where data may not be handed out to third parties. –  the-wabbit Jun 17 '11 at 8:13
    
syneticon, thanks for your suggestion. Don't you think that the same can be achieved easily with SSH forwarding/tunneling? –  yegor256 Jun 18 '11 at 1:14
    
You could set up a reverse SSH tunnel from your office server to your rackspace server instead of using an OpenVPN connection, but I consider it harder to manage - you would need to write scripts around ssh to check for aborted / failed connections for an automatic re-initiation for example and you can't do simple diagnostics like a "ping" through an SSH tunnel which are useful especially when doing monitoring. –  the-wabbit Jun 18 '11 at 10:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.