How can Rackspace cloud servers be set up with an EC2 type approach to firewalls?

Question

I'm looking at using Rackspace cloud servers for some Windows based web hosting, and having used Amazon EC2 for similar projects before, I was disappointed to find Rackspace don't employ the EC2 security zone based approach for firewalling.

I thought it would be possible to add a low spec (cheap) Linux box to the Rackspace environment and set that up to act as a firewall/gateway to the Windows boxes, so that the linux box's external IP became the single point of entry to the Windows machines, but I'm getting nowhere fast at the moment. It's possibly my lack of Linux knowledge but after a day of tinkering with iptables on every flavour of Linux Rackspace offers I can't get something as simple as forwarding requests on port 80 to the internal address of my Windows web server to work.

Has anyone else had any success with such a set up, or got any ideas on a better strategy?

Answer 1

Rackspace now has Security Groups!
Before this, though, it would certainly be possible to use a Linux box as a firewall. The Vyatta server image is designed just for this purpose—though it's not a "cheap server" at $6.24/d, it is a cheap firewall.

Answer 2

echo 1 > /proc/sys/net/ipv4/ip_forward
PUBLIC_IF=eth0  
DMZ_IF=eth1
PORT=80
/sbin/iptables -A PREROUTING -t nat -p tcp --dport $PORT -i $PUBLIC_IF -j DNAT -to $DMZ_IP:$PORT
/sbin/iptables -A FORWARD -p tcp -d $DMZ_IP --dport $PORT -i $PUBLIC_IF  -o $DMZ_IF -j ACCEPT
/sbin/iptables -A FORWARD -p tcp -s $DMZ_IP --sport $PORT -i $DMZ_IF -o $PUBLIC_IF -j ACCEPT

I got the idea that your interfaces are eth0/eth1 from http://cloudservers.rackspacecloud.com/index.php/Using_your_private_IP_address . Feel free to adjust though.