Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm not even sure if this is possible... Also, please forgive my ignorance on the subject.

What I'm looking for is for "something" that would allow me to redirect all TCP traffic arriving to host A to host B, but based on some rules.

Say host A (the intermediary) receives a request (say a simple HTTP request) from a host with domain X. In that case, it lets it pass through and it's handled by host A itself.

Now, let's suppose that host A receives another HTTP request from a host with domain Y, but this time, due to some customizable rules, host A redirects all the traffic to host B, and host B is able to handle it as if came directly from domain Y. And, at this point, both host B and the host with domain Y are able to freely communicate (of course, thought host A).

NOTE: All these hosts are on the Internet, not inside a LAN.

Please, let me know if the explanation is not clear enough.

share|improve this question
1  
Exactly what are you trying to do? –  Michael Hampton Oct 20 '13 at 1:16
    
This is entirely possible. Can you specify if you are only looking to do this with HTTP, or with other services also (ssh, ftp, etc). Also what webserver are you using? Apache, nginx, IIS? –  David Houde Oct 20 '13 at 1:22
    
@DavidHoude: If possible, I wouldn't want to restrict any protocol, but if that were to be necessary I'd be happy with www, ftp, ssh and smpt. As for the server, I'm running Apache, but this is the "target" machine (B); the machine handling the redirection (A) is running Windows Server 2008R2. –  xfx Oct 20 '13 at 4:35
    
@MichaelHampton: I have a number of web sites hosted on an unmanaged server which I'm just about to cancel, for reasons that don't pertain to this thread. So I would like to be able to re-configure all my domains (registered at NetSol) to point to a machine with an static IP (that would be host A) and then have it redirect all traffic to a local (in-house) computer (host B), which unfortunately, has a dynamic IP address. That is basically it. –  xfx Oct 20 '13 at 5:01
1  
If you are going to cancel it, why spend time configuring it to route to another host? There are plenty of dynamic DNS solutions for those without static IP's. You should make the switch between hosts using DNS. –  David Houde Oct 20 '13 at 9:18

6 Answers 6

up vote 0 down vote accepted
+100

You could use haproxy by setting up one frontend with multiple backends based on your rules:

frontend my_front
    mode http
    bind <ip_address>:80
    option forwardfor
    use_backend backend1 if <condition>
    use_backend backend2 if <condition>

backend backend1
    mode http
    server server1 localhost:8000

backend backend2
    mode http
    server server2 remote_server:8000

You can read more about it on haproxy site: http://haproxy.1wt.eu/

share|improve this answer
    
I think this is it!!! At a first glance it appears to be similar to rinetd with lost of powerful rules, including some that can be based on the domain name, which is exactly what I need it. Thank you Mihai! –  xfx Oct 28 '13 at 16:46

What you are describing in a TCP Proxy. If you were only looking to redirect HTTP Connections, you would only need an HTTP Proxy.

A commonly used TCP Proxy is rinetd.

From debian-administration.org:

The rinetd package contains a simple tool which may be configured to listen for connections upon a machine, and silently redirect them to a new destination. In short it acts as a simple to configure TCP proxy.

It does not matter if you are on the internet or inside a LAN, as long as you can route to the new IP and no firewall gets in your way.

share|improve this answer
    
rinetd also runs on Windows Server 2008R2. –  Ecolitan Oct 22 '13 at 19:21
    
That sounds promising. How about support for additional ports, such as 25, 110, etc...? –  xfx Oct 23 '13 at 10:27
    
rinetd allows you to redirect as many ports as you would like. –  Ecolitan Oct 23 '13 at 14:01
    
I have started playing with rinetd and it does exactly what you describe, unfortunately it does not allow host names in the rules section; from the man page: Host names are NOT permitted in allow and deny rules... and without host-based rules, I won't be able to achieve what I'm looking for. –  xfx Oct 23 '13 at 19:41
    
Any special reason why you want to use host names and not IP addresses? –  RSchulze Oct 26 '13 at 23:06

Perhaps you could use socat?

socat TCP-LISTEN:80,fork TCP:my.newservername.com:80
share|improve this answer
    
Actually, it's the reverse. I would like to ONLY redirect, based on the incoming host name. For example, if serverfault.com tries to connect, then all traffic is allowed to pass through to server handling the routing/redirection. But, if mydomain.tld is detected, then I want all the traffic to be redirected to xxx.xxx.xxx.xxx –  xfx Oct 23 '13 at 22:18

Most hardware/software firewall solutions can do this work for you based on source ip.

If you want to make decision based on source domain than following hardware firewalls can certainly do It: DLINK DFL series (at least senior models), CheckPoint, Cisco ASA.

People also say that software FW Comodo can do It (http://www.wilderssecurity.com/showthread.php?t=245901). But I am not sure.

Take into account that any non-windows software solution you will luck to find can also be deployed as VM on your Windows 2008R2.

share|improve this answer

What I'm looking for is for "something" that would allow me to redirect all TCP traffic arriving to host A to host B, but based on some rules.

iptables is best (despite the haters)

Say host A (the intermediary) receives a request (say a simple HTTP request) from a host with domain X. In that case, it lets it pass through and it's handled by host A itself.

to make this statement make sense, im guessing you mean host A running http on tcp/80. there is another host between then internet and host A, and you route -s 0.0.0.0/0 to host A:80. if you mean host A is live on the internet, dont do that, until you know iptables well :P

Now, let's suppose that host A receives another HTTP request from a host with domain Y, but this time, due to some customizable rules, host A redirects all the traffic to host B, and host B is able to handle it as if came directly from domain Y. And, at this point, both host B and the host with domain Y are able to freely communicate (of course, thought host A).

ok,so now i dont think you are talking about layer 3/4 here, but layer 7 rewrites... try .htacess on apache or even better nginx (is there any other choice?)

NOTE: All these hosts are on the Internet, not inside a LAN.

d00d read what i said above. learn iptables fast. protect yourself.

Please, let me know if the explanation is not clear enough.

the explination is not clear enough. try g00gle first.

share|improve this answer
    
Perhaps the answer I gave to RSchulze (above) is a bit easier to understand. –  xfx Oct 27 '13 at 1:50

If what you are after is a general TCP level solution, then you should accept Ecolitan's answer as correct, and award the bounty. I see you have shown some interest in redirecting other services.

If you are only interested in HTTP, or rinetd won't do all you need, then nandoP's answer about using .htaccess is along the right lines (one solution, anyway), but you'd need to know a bit more. Alternatively, you could use dedicated proxy software like varnish or squid. If you're familiar with Apache you might as well stick with that.

An apacherule would redirect eg http://www.example.com/foo to http://hostb.example.com/foo, and then, unless you do something about it, hostB would see the request coming in as being for that domain. Depending on your web site, you would most likely need to fix things up on hostB as well in order that it didn't start sending out pages with URLs in it that refer to hostb.example.com.

If you have an older apache version, you might need to fix up the host header on hostB, but as of Apache 2.0.31, there's a ProxyPreserveHost directive (see docs for mod_proxy) which you can put on hostA.

It's been a while since I needed this, and I just found out about ProxyPreserveHost. It looks like you need something like this on hostA (untested):

<VirtualHost *:80>
  Servername www.example.com

  RewriteEngine on
  ProxyPreserveHost on

  RewriteCond %{REMOTE_ADDR}       ^123\.45\.67\.[0-9]*$
  RewriteRule    ^(.*)$  http://hostb.example.com/$1  [P]

  ...

</VirtualHost>

It'd be possible to add multiple domains to this serverconfig, but it's probably better to configure as above separately for each domain.

If the RewriteCond doesn't match, then it'll process other rules in the virtualhost config.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.