3

I have 2 servers

  • the first (SRV01) is running Bind and other web app
  • the second (SRV02) is running 2 server Minecraft (^^)

in Bind I have 2 A recording for the 2 server MC

s1.domain.tld    A    SRV02IP
s2.domain.tld    A    SRV02IP

the 2 MC serv are running on 2 different port 25565 and 25566

so I want that the request from s1.domain.tld:25565 are going to SRV02IP:25565 and the request from s2.domain.tld:25565 are going to SRV02IP:25566

I think I need do this in the SRV02 iptables. I have looking some topic about iptables but nothing pertinent to me.

could you help me ?

rgds.

3 Answers 3

1

As long as both servers are publicly accessible, this is possible. Point s1.domain.tld to SRV01IP and point s2.domain.tld to SRV02IP. s2.domain.tld:25565 already works. Setup minecraft on :25566 on SRV02IP, and then in iptables on SRV01IP you need to forward :25565 to SRV02IP:25566:

iptables -t nat -I PREROUTING -p tcp --dport 25565 -j DNAT --to-destination SRV02IP:25566
iptables -t nat -I POSTROUTING -p tcp --dport 25566 -j MASQUERADE

Finally, to make it work you'll need to enable IP forwarding in proc:

echo "1" > /proc/sys/net/ipv4/ip_forward

All set. One thing to note is that this won't persist between reboots. To make it persist make sure you save your IPTables rules (differs depending on distro) and edit /etc/sysctl.conf to make the ip_forward persist by editing the following line (or adding it if it doesn't exist):

net.ipv4.ip_forward = 1

12
  • yes the 2 server are publicly accessible s1.domain.tld need to point to SRV02IP:25565 and s2.domain2.tld point to SRV02IP:25566 Oct 22, 2012 at 21:47
  • ok no problem I have miss read Oct 22, 2012 at 21:48
  • I can't add your iptables rules, i see nothing with iptables --list Oct 22, 2012 at 22:00
  • You won't because iptables --list doesn't show the nat table by default. Try iptables -t nat --list
    – James L
    Oct 22, 2012 at 22:14
  • I have a trouble, now, with some similar, I have try this : iptables -t nat -A PREROUTING -p tcp -d ts.domain.tld --dport 9987 -j DNAT --to-destination domainIP:9988, but ts.domain.tld is replace bay the kimsufi hostname in the iptable list Oct 22, 2012 at 22:23
2

Just bind another IP to SRV02. If you don't have extra external IP's can also use internals (with some extra tricks). Install Squid proxy. That can redirect the traffic to another port.

http://www.linuxquestions.org/questions/linux-networking-3/debian-iptables-squid-redirect-port-80-to-port-8080-on-another-machine-474027/

1
  • A reverse proxy would do. If not squid fits your need, you could probably do it with apache.
    – jishi
    Oct 22, 2012 at 15:58
0

It sounds like you have one public IP and two back-end servers with private IPs (?) - If this is the case what you are asking is impossible: You cannot have two applications listening on the same port and (public) IP address.

You cannot do this from DNS (DNS A records have no concept of "port"), and doing it from iptables is the Wrong Thing (it may not even be possible, but if it were it would involve doing DNS lookups in a firewall rule which is not something I would advise).
You need two public IP addresses to make this work, or you need to run one of your Minecraft servers on an alternate port.

3
  • IPTables can do hostname lookups but it only resolves them when the rules are loaded. It's not recommended. I think IP is fine in this instance though.
    – James L
    Oct 22, 2012 at 16:19
  • @JamesLawrie Can != Should -- No matter where it's done I'm 1000% against making IP-level configuration (firewalls) depend on the ability to resolve hostnames (DNS)...
    – voretaq7
    Oct 22, 2012 at 16:28
  • See my "it's not recommended" in the above comment. My comment was only in response to "it may not even be possible", which it is. I've given OP a solution which doesn't depend on hostname lookups.
    – James L
    Oct 22, 2012 at 16:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .