Iptables and Name-Based Virtual Hosting

Yahooguntu · 08-25-2009, 10:11 AM

I am building an iptables-based gateway that will route traffic from the WAN to two different servers on the LAN. One server is using name-based virtual hosting for two websites, and the other will be running one or more websites in the future. If the gateway has only one WAN IP address, is there some way for iptables to route incoming traffic based on the "Host" HTTP header? If not, is there a way to go about doing this?

Thank you for your time.

Berhanie · 08-25-2009, 10:28 AM

You cannot solve this problem below the application layer, since a TCP connection needs to be opened to the correct web server even before any application data (e.g. the "Host:" header) is sent. Look in the direction of reverse proxies for a possible solution. Welcome to LinuxQuestions.

Yahooguntu · 08-26-2009, 08:35 AM

Thanks for your help. I looked up "reverse proxy" on Wikipedia, and there seem to be a lot of choices. Can anyone recommend one? Load balancing might be needed in the future.

centosboy · 08-26-2009, 09:20 AM

Quote:

Originally Posted by Yahooguntu

Thanks for your help. I looked up "reverse proxy" on Wikipedia, and there seem to be a lot of choices. Can anyone recommend one? Load balancing might be needed in the future.

Code:

http://wiki.nginx.org/Main

never used it but heard some good things about it

kdelover · 08-26-2009, 09:44 AM

well i did something like this i have two virtual hosts running on a single box listening on ips 40000 and 40002 on the firewall which has 1 wan interface , i did a portforwarding using iptables,something like this

iptables -t nat -I PREROUTING -p tcp -s 0.0.0.0/0 -d 124.0.0.0/8 --dport 20000 -j DNAT --to-destination 192.168.1.2:40000

iptables -t nat -I PREROUTING -p tcp -s 0.0.0.0/0 -d 124.0.0.0/8 --dport 20002 -j DNAT --to-destination 192.168.1.2:40002

Yahooguntu · 08-26-2009, 07:27 PM

So if I were setting this up with a reverse proxy, would iptables need to route incoming traffic to the proxy or to the destination interface? Does the proxy intercept traffic going onto the LAN, or does the traffic need to be directed there? Also, would iptables need to be set up somehow to route traffic from the proxy to the LAN?