is it possible (it is with M$ ISA) with iptables to forward based on http IP header information

example.
behind firewall has 3 web servers
www.Web-A.com 10.0.0.1
www.Web-B.com 10.0.0.2
www.Web-C.com 10.0.0.3

atm I can blanket forwared port 80 to one of the web servers. but like M$ ISA I would like to forward to the correct server behind the firewall.

web-A would forward to 10.0.0.1
web-B would forward to 10.0.0.2
web-C would forward to 10.0.0.3


is this possible with IPTABLEs.. if so how ?

any one

heheh done that already.. other wise I would not have asked.

none off those pages taking about Http header redirection. they only talk about IP redirection

I want IPtables to read the http header for the domain then redirect to the appropriate web server.

with IP redirection you can only send it to 1 server not many.




the more I look into this.. the more I will have to convert to M$ ISA

Iptables isn't really meant to do application layer filtering. You might have some luck with Zorp though.

There is a 'strings' extension for iptables that can be installed by Patch-o-matic. You could then filter/route based on the http request strings, but that's a pretty ugli hack IMO.

thanks dude .. I thought as much. I will give the 'Strings' patch-0-matic ago.

if not.. its back to installing m$ ISA hehhehe oh well

freibuis out

There is also the "Layer 7" netfilter patch which lets you do a regex on the first few packets.

Whouldn't an apache reverse proxy work?

Yes. You could also use mod_rewrite as well, but both would require an Apache front-end.

@freibuis;
FWIW, I'd use Zorp or put an Apach front-end up, rather than trying to use the string match.

I had an idea for the last week or so to use Squid. but in the same manor.. just reverse it. that way I just put rules it.. I dont know how it would work but I will give it a go..

that layer 7 netfilter is a very kewl idea.. but I dont think it would work with forwarding.



the router/firewall has Apahce running on already (on the internal IP not external IP) I will give it a go and see what happens..

after that I am going to research more into the Squid idea as the server already uses squid as a proxy.. I could just add more rules in and see what happens