1

I have installed varnish on my server and would like to test the configuration without affecting normal usage. I have apache listening on port 80 and varnish on port 8080. So, I want all requests from my IP a.b.c.d to pass through varnish and all the other IPs should be allowed to access apache normally.

I read somewhere that it is possible to use PREROUTING in Iptables to achieve this. Can some one please tell me how to do it? I have 2 sites hosted on the server, is it possible to configure this for just one domain?

Update
I tried the command, but it did not work

root@git:~# iptables -A PREROUTING -t nat -i venet0 -p tcp -s 117.201.192.67 --dport 80 -j REDIRECT --to-port 8000
root@git:~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
root@git:~# iptables -A PREROUTING -t nat -i venet0:0 -p tcp -s 117.201.192.67 --dport 80 -j REDIRECT --to-port 8000
Warning: weird character in interface `venet0:0' (No aliases, :, ! or *).
root@git:~# iptables -A PREROUTING -t nat -p tcp -s 117.201.192.67 --dport 80 -j REDIRECT --to-port 8000
root@git:~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

I am on a VPS and do not have an interface named eth0. /sbin/ifconfig lists lo, venet0, venet0:0, venet0:1 and venet0:2 only.

Update 2 - Inserting the rule at the beginning worked

iptables -t nat -I PREROUTING -p tcp -s 117.201.192.67  --dport 80 -j REDIRECT --to-port 8000

Is it possible to check the requested hostname too? I would like to redirect only requests for mydomainname.com

Improve this question

1 Answer 1

Reset to default
2

You can specify source address (or network) in an iptables redirect as follows:

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

The rules are read from top to bottom, and first match goes, so you might have to stick it in the right place.

Improve this answer
4
  • I am new to iptables. How can I configure it to redirect only requests from the ipaddress a.b.c.d?
    – Joyce Babu
    Apr 27, 2011 at 9:59
  • 1
    Add -s a.b.c.d to the rule. -s means source of the packet.
    – Paweł Brodacki
    Apr 27, 2011 at 10:07
  • 1
    Use -I to insert the rule at the beginning of the chain.
    – user9517
    Apr 27, 2011 at 11:26
  • Thanks it worked. Is it better to add -i venet0? Also is it possible to check the requested hostname too?
    – Joyce Babu
    Apr 27, 2011 at 11:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.