0

I have got three servers. The first one is a apache reverse proxy server, the second and third one are web servers. The proxy server has two NIC's and NAT is in place to route packets from the broadband router to the web servers and vice versa...

But i am little bit confused as of how to configure iptables to forward traffic to port 80, 53, 25 & 21 of the two servers from the gateway. The two web servers have a numerous sites hosted on them.

So i want my developers and customers to have access to various services from the servers like webmails, ftp, etc...

What is the best possible solution with iptables?

Improve this question
1
  • Just a slight suggestion: As I have a similar setup I found it way easier to use a proper firewall called pfSense for setting and handling NAT as well as additional analysis. See: pfsense.org
    – Flatron
    Feb 3, 2017 at 9:25

1 Answer 1

Reset to default
0

You just need a DNAT.

I hope this little example help to explain:

iptables -t nat -A PREROUTING -i $IF_INET -p tcp -d $IP_INET --dport 8080 -j DNAT --to-destination 192.168.0.10:80  # to port 80 on server1
iptables -t nat -A PREROUTING -i $IF_INET -p tcp -d $IP_INET --dport 8081 -j DNAT --to-destination 192.168.0.11:80  # to port 80 on server2
Improve this answer
5
  • so what should be the virtualhost file like ...? I have defined my virtual hosts as follows: <Virtualhost 192.168.1.99:80> ServerName server1.abc.com ProxyPass / 192.168.2.1:80 ProxyPassReverse / 192.168.2.1:80 </Virtualhost> <Virtualhost 192.168.1.99:80> ServerName server1.abc.com ProxyPass / 192.168.2.1:80 ProxyPassReverse / 192.168.2.1:80 </Virtualhost>
    – Renjith
    Feb 5, 2017 at 7:34
  • I can only access websites on one server, but the cpanel login page comes on the domain address (eg. xyz.com) and cpanel ipaddress. Totally screwed.
    – Renjith
    Feb 5, 2017 at 7:41
  • what do you mean by IF_INET and IP_INET?
    – Renjith
    Feb 6, 2017 at 4:55
  • @Renjith you not need to change virtual hosts. But you have 2 servers each of which listen on port 80 (53, 22, 25 etc). If I get you right, you developers and customers need to access to this internal servers from external site. I wrote iptables rules that forward 2 different external ports of gateway to equal ports on internal hosts. IF_INET is you interface to Internet, IP_INET is external IP address.
    – Alexey Reytsman
    Feb 6, 2017 at 8:07
  • i have apache proxy setup in PC1 which has two nic and its nated too. From PC1 i have connections going into a switch which has server1 and server2 connected with it. So according to you i just have to connect servers directly to the gateway without apache proxy... is that right?
    – Renjith
    Feb 9, 2017 at 9:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.