Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm hoping someone can help me with this configuration. I already have a working setup where a Linux box is acting as a router just doing port forwarding for public IP's. These are all public IP's btw.

HOST_x - Can be any host with public IP. (ex: x.x.x.x)

MY_LINUX - Using IPtables just doing port forwarding for public IP's. (Fixed IP, ex: 2.2.2.2)

SERVER - Web server having public IP address. (Fixed IP, ex. 3.3.3.3)

PORT - (TCP PORT = 80)

Here's the config on MY_LINUX:

iptables -t nat -A PREROUTING -p tcp -d 2.2.2.2 --dport 80 -j DNAT --to-destination 3.3.3.3:80 iptables -t nat -A POSTROUTING -p tcp -d 3.3.3.3 --dport 80 -j MASQUERADE

The configuration above works. When HOST_x types in 2.2.2.2 on the browser it gets the webpage from 3.3.3.3.

The only issue I have here is that the destination SERVER (3.3.3.3) sees the request coming from MY_LINUX (2.2.2.2), what I want to see is the original IP of the requesting HOST_x (x.x.x.x).

I would appreciate any suggestions, thank you.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

I'd say this is not possible at the Layer-3 level. HOST_x is expecting remaining packets to come from the host where it initiated the connection MY_LINUX. If SERVER would suddenly get in the middle of the TCP handshake and reply, HOST_x would just ignore those packets.

Since HOST_x and SERVER have direct connectivity, I think it'd be better to move this routing scheme to the application layer and implement HTTP redirects. Then HOST_x opens a connection directly to the end point.

share|improve this answer
    
This would only be possible if MY_LINUX is the default gateway for SERVER. –  mgorven Feb 13 '13 at 18:42
    
@gtirloni - that's what I thought as well, thanks for clarifying. –  halflogic Feb 13 '13 at 19:29

You can do this if you have access to the webservers (or their gateway), too. The only solution that comes to my mind is a tunnel between router and webserver. Then the webserver (gateway) can send all reply packets to the router without having to adjust the destination address. If that is an option for you then I am going to have a look at the details.

share|improve this answer
    
Thanks unfortunately I don't have access to the destination servers. I only have access to MY_LINUX that only does port forwarding, destination can be any tcp based service. –  halflogic Feb 13 '13 at 19:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.