2

I have looked around and have seen many IP forwarding solutions that forward requests from an IP on one server to another IP on another server. (Basically, the forwarding of requests going to 123.45.67.89 on server X to 98.76.54.321 on server Y.) Those solutions usually involve enabling IP forwarding in the Linux kernel and adding iptables rules to make everything work.

However, I am not sure if server Y (and its IP 98.76.54.321) will be exposed when doing the forwarding. I'm basically aiming for a reverse proxy, but for any port or protocol on TCP/UDP.

Basically, does Linux IP forwarding automatically act as a reverse proxy, or must other steps be taken to ensure that the identity of server Y (its IP) is not revealed through server X? Or am I considering the wrong solution altogether?

2 Answers 2

4

Linux IP forwarding is basically routing. It doesn't by itself proxy, or really alter the traffic at layer 3 and above at all.

That said, if you want to have something that masks the location of traffic, you could consider setting up NAT using iptables to masquerade (or source NAT) the traffic so that the source IP is that of the linux server. This works in conjunction with forwarding.

To do this thing you must DNAT the inbound traffic (change its destination address):

iptables -t nat -A PREROUTING -d ${server_x} -j DNAT --to-destination ${server_y}

Then, you must change the source address so the hidden server sends traffic back through the forwarder:

iptables -t nat -A POSTROUTING -d ${server_y} -j SNAT --to ${server_x}

You could consider predicating these on a protocol and port as well, if that is what you want.

2
  • Could you provide a quick example of how to do that, using my example IPs above? (My assumption is that the configuration is only needed on server X.)
    – Albert H
    Jul 17, 2013 at 23:43
  • This is a good assumption. You would need a rule, but it's usually predicated on interfaces and not IPs. It will be a pair of rules; maybe I will edit to give you a couple examples. Jul 17, 2013 at 23:46
2

You haven't fully explained the problem you're trying to solve, just how you think you can solve it, then asked for other options... So this answer may be somewhat vague, but I'll give it anyway.

Firstly, for the love of all things holy, AVOID NAT. Please. A unicorn cries everytime a new NAT is created.

Solution 1

If your servers have public IP's, just use routing (IP Forwarding) and appropriate firewall rules (iptables) to control what is allowed through.

For example:

Internet <==> Perimeter (123.45.67.89) <==> Server (98.76.54.321)

Enable IP Forwarding (routing) on the Perimeter host, then put in the firewall rules to only allow the traffic that you want to be able to reach the server, DROP or REJECT all other traffic.

Solution 2

If you really want to "hide" the Server so the "internet" believes it is actually talking to "Perimeter" even though it's actually dealing with "Server", then install proper Reverse Proxy software on "Perimeter" and have it do it's thing. This will require more resources on the Perimeter host, but hides "Server" and avoids NAT (Did I mention to avoid NAT?)

Solution 3

If you really have to because 1 and 2 aren't viable for whatever reason, go with the NAT suggestion.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .