In moving a website with a dedicated IP from one server to another, to minimize downtime due to DNS propagation delays, there's the approach of using IP forwarding so that all traffic to the original IP gets forwarded to the new IP.
Is there anything important to know when doing this? Here are the steps I plan to use. Is there anything from a security perspective or otherwise that I'm missing?
echo "1" > /proc/sys/net/ipv4/ip_forward(or set it permanently)
iptables -t nat -A PREROUTING -d original.ip.goes.here -p tcp --dport 80 -j DNAT --to-destination new.ip.goes.here
iptables -t nat -A POSTROUTING -p tcp -d new.ip.goes.here --dport 80 -j MASQUERADE
- Repeat #2 and #3 but for port
80if the site has SSL
I understand downtime can be reduced without resorting to this by lowering the TTL of the DNS records far enough in advance of the change, but that's still not quite as good at this at minimizing downtime since supposedly some DNS servers (and perhaps clients) will cache records for longer than the TTL says if it's short.
Part of what got me wondering if there's something I'm missing is the question of why
ip_forward isn't always set to
1 and instead defaults to
0 - like is there some security risk or undesired behavior if having it set to
1 in certain situations.