Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have one notebook and two servers:

  • ip = 172.17.0.2 (I have installed nginx here)
  • ip = 172.17.0.3 (There is nothing here, but I can ping 172.17.0.2 from here)

I open browser on my notebook, open

http://172.17.0.2 

and get web page from Nginx.

Now I want to do something so, if I will open

http://172.17.0.3 

in the browser this server forward my request 172.17.0.2 and return me same page back.

I have connected to 172.17.0.3 and make this changes:

root@6d2de436eef0:/# sysctl net.ipv4.ip_forward=1
net.ipv4.ip_forward = 1
root@6d2de436eef0:/# iptables -t nat -F PREROUTING
root@6d2de436eef0:/# iptables -t nat -A PREROUTING -d 172.17.0.3 -j DNAT --to-destination 172.17.0.2 
root@6d2de436eef0:/# iptables -F FORWARD
root@6d2de436eef0:/# iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
root@6d2de436eef0:/# iptables -A FORWARD -m conntrack --ctstate NEW -d 172.17.0.2 -j ACCEPT
root@6d2de436eef0:/# iptables -P FORWARD DROP

Now I open

http://172.17.0.3, 

but get nothing. Why and how can I fix it ?

Update

Here is a result of tcpdump on 172.17.0.3 - http://pastebin.com/47MRWqXy

Update 2

Sorry, I gave you not full information. Both servers 172.17.0.3 and 172.17.0.2 are docker containers. Here is ifconfig on the host machine:

$ ifconfig
docker0   Link encap:Ethernet  HWaddr fe:69:ac:53:70:53  
          inet addr:172.17.42.1  Bcast:0.0.0.0  Mask:255.255.0.0
          inet6 addr: fe80::f0ee:53ff:feae:aa6c/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:162525 errors:0 dropped:0 overruns:0 frame:0
          TX packets:278054 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:10471915 (10.4 MB)  TX bytes:436185034 (436.1 MB)

eth0      Link encap:Ethernet  HWaddr f0:de:f1:27:7a:e6  
          inet addr:172.20.0.136  Bcast:172.20.0.255  Mask:255.255.255.0
          inet6 addr: fe80::f2de:f1ff:fe27:7ae6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:16023892 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4007904 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:8557520703 (8.5 GB)  TX bytes:484890281 (484.8 MB)
          Interrupt:20 Память:f8500000-f8520000 

eth1      Link encap:Ethernet  HWaddr 82:ea:96:9d:48:88  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
share|improve this question

2 Answers 2

up vote 1 down vote accepted

A way to "forward" 172.17.0.3:80 to 172.17.0.2:80 could be to use an inetd server.

Then, you will be able to redirect http://172.17.0.3 to http://172.17.0.2

On Server 172.17.0.3 :

apt-get install xinetd

Edit /etc/xinetd.conf and add something likle this :

service my_redirector
{
 type = UNLISTED
 disable = no
 socket_type = stream
 protocol = tcp
 user = root
 wait = no
 port = 80
 redirect = 172.17.0.2 80
 log_type = FILE /tmp/somefile.log
}

Restart xinetd : service xinetd restart

Now, http://172.17.0.3 should redirect you at http://172.17.0.2

No need of iptables anymore here.

share|improve this answer

You can't use DNAT if both servers are in the same network.

DNAT is for address translation (a.k.a. firewall), FORWARD is useless in this case because this packets doesn't pass through the server2.

You need a http proxy or load balancer.

Another options is setting a simple index.html in apache into the server2 and use redirect meta tag.

share|improve this answer
    
I agree on the high level solution, but out og curiosity: Wouldn't it be possible to use a pre-routing rule to edit the dest IP, allowing it to be sent to .2? –  Jervelund Feb 18 at 8:07
    
because isn't logic to route packets on two servers that belong to the same subnet. It's impossible to define routes, the routes exists to move packets between different networks. And NAT is basically a router that allow us to move packets from one network to another. The solution proposed is basically an awful trick. IMHO. OK, probably works but the nginx server only will see .3 as client in the access log –  fbs Jun 28 at 4:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.