Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm basically wondering what is best practice when running multiple web-services that all need to be on port 80 without using something like nginx as a proxy. The following solution is actually working but I'm wondering if I'm actually doing this correctly.

Currently I am doing something like this in my iptables:

*filter
-A RH-Firewall-1-INPUT -m state --state NEW -d 1.1.1.1 -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -d 1.1.1.1 -m tcp -p tcp --dport 8081 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -d 1.1.1.2 -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -d 1.1.1.2 -m tcp -p tcp --dport 8082 -j ACCEPT

*nat
-A PREROUTING -d 1.1.1.1 -p tcp --dport 80 -j DNAT --to 1.1.1.1:8081
-A PREROUTING -d 1.1.1.2 -p tcp --dport 80 -j DNAT --to 1.1.1.2:8082

I would point my DNS to 1.1.1.1 for foo.com and bar.com would resolve to 1.1.1.2 but both operate on 80 externally.

I greatly appreciate any input/suggestions, I'm currently running CentOS 5.5.

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Why wouldn't you just make both webservers (or whatever they are) bind to port 80 on the different IP addresses? (Ab)using iptables in this manner just confuses people (I know, I've worked in an environment that did this; it was painful, annoying, unproductive, and unnecessary).

share|improve this answer
1  
I feel pretty stupid, thank you for the obvious solution. I knew something was weird which is why i posted the question, hopefully someone else benefits from it. My default webserver was eating up all the requests on any IP using 80, but after fixing that it allowed me to do exactly what you suggested ;) –  Chad Scira Jul 4 '11 at 6:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.