I've a server listening on port 10000. But this server is running only in a special case (then some third service is available). Otherwise the port is not listened. Is it possible to redirect the client to another port if 10000 is not listening?

I see two solutions: 1) insert/remove iptables rules on server start/stop, but since the server may be killed, it may not insert the correct iptable redirect rule before dieing.

2) make a permanent userspace rule that checks if the port is listening and redirects the packet if not listened.

How to do 2) ? Do someone have recipes for ipq?

May be someone can suggest me a better way?

It is something like fallback redirect: I'll have thousand of clients with different ports (10000-11000) and if their instance of server is not running, whey should be redirected to some page explaining why they don't have and instance connected.


Use the -m socket match.

See this webpage for some more explicit instructions: http://carnivore.it/2009/11/22/iptables_-_match_closed_ports

| improve this answer | |

I think a better option is to use a load balancer such as haproxy. You can configure it to listen on many ports and use different back-end servers.

To implement the functionality of redirecting the user to a different port (or different server), you can use backup option in haproxy.

This is an oversimplified configuration for your front-end (clients) and back-end servers:

frontend my_clients
        acl its_ok always_true
        use_backend my_backend if its_ok
        default_backend my_backend
backend my_backend
        balance source
        server  server1 IP:port other options...
        server  server2 IP:port other options...

As said here, you can use backup keyword. This means that backup server will be used only when there is no other non-backup server available.

This is used primarily for HTTP load balancing, but they say that it can be used for other tcp-based services.

| improve this answer | |
  • Good idea, I thought about some ngnix or other proxy. Before accepting this solution I would like to see if any other ideas would come. May be iptables nf queue would be more simple? – PoltoS Mar 8 '11 at 9:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.