Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Scenario:
I built a server(S) with openvpn.
And there might be several vpn clients(C1~C10) providing SSH/FTP/HTTP behind "S"
Several users(U1~U10) on internet will login through 'S' to access their own machine (C1~C10).

Assume that the U3 ip is 60.60.60.60
the S ip is 220.220.220.220
the C3 vpn ip is 10.8.0.6
and the forwarding port is '55555'

If a user(U3) types the correct user/pwd
--> 'S' will query which client(C3) belongs to the user and get its IP,
then DYNAMICALLY portforward the user(U3) to his client(C3) with:

//(only the 60.60.60.60 can access 10.8.0.6)  
iptables -t nat -I PREROUTING -i eth0 -s 60.60.60.60 -p tcp --dport 55555 -j DNAT --to-destination 10.8.0.6:80

It's success so far.

But after the user logout, I delete this rule with

iptables -t nat -D PREROUTING -i eth0 -s 60.60.60.60 -p tcp --dport 55555 -j DNAT --to-destination 10.8.0.6:80

This rule no more exist in 'iptables -t nat -L -n',
but the user U3 can still directly access C3 with 220.220.220.220:55555

That rule keep working even I type the following and reboot.

iptables -t -nat -F

Help! Could anyone tell me what's wrong or is there a better way


I've found what the problem is.

I test what above with HTTP, but there is a proxy server at 'U3' side.

That is, what you see is old data cached by proxy.

Try other protocols, such as SSH or NC, the the result is correct.

But... that means this iptables mechanism may not work well if a user use proxy,

How could I solve this problem?

share|improve this question

migrated from stackoverflow.com Sep 27 '12 at 13:20

This question came from our site for professional and enthusiast programmers.

add comment

1 Answer

But... that means this iptables mechanism may not work well if a user use proxy. How could I solve this problem?

You can serve content with Cache-Control: no-cache, no-store and hope that the proxy respects this.

RFC 2616 Fielding, et al.

share|improve this answer
    
thanks a lot. I will try it –  Smith.Lai Sep 28 '12 at 6:13
    
I've set this but with no luck. And I'm encountering another problem, would you mind having a look at this serverfault.com/questions/432837/…? –  Smith.Lai Sep 28 '12 at 7:39
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.