2

We use a service that allots us X number of requests per IP and has allows us to setup 5 IPs with such a limit (I know.. it seems stupid they could not just up the limit 5x on one IP).

Pretend I have a linux box with the following address on the internet: 66.249.90.104 - that is an Google IP and not mine... so feel free to try to hack into it :)

I setup apache+mod_proxy as a forwarding proxy (ProxyRequests On). i.e. you can setup firefox to use 66.249.90.104:8080 as a proxy, and all firefox traffic comes out as 66.249.90.104.

So far so good.

Problem:
Now I add more alias interfaces so the total looks like this:

eth0: 66.249.90.104
eth0:1 66.249.90.105
eth0:2 66.249.90.106
eth0:3 66.249.90.107
eth0:4 66.249.90.108

I run apache+mod_proxy (single apache instance) which binds to all interfaces, but no matter which address I connect to use the forwarding proxy, all traffic goes out to the internet as 66.249.90.104

I have also tried running 5 different apaches, each binding to its own interface only, but that still sends the outbound request through 66.249.90.104.

I was hoping to get it to work as follows:
I connect to 66.249.90.108 and make a proxy request, and it goes out as 66.249.90.108.
I connect to 66.249.90.107 and make a proxy request, and it goes out as 66.249.90.107.
etc.

Has anyone else had to deal with this issue? The fall back solution would be to just run apache on 5 separate boxes, but I would prefer it to all work on one box.

Thanks!

aspitzer
  • 977
  • 5
  • 14

2 Answers2

1

It appears mod_proxy does not have an option to select source IP when it opens the socket. However you can use iptables to SNAT traffic from a user to a pool of addresses.

iptables -A POSTROUTING -m owner --uid-owner httpd -j SNAT --to-source 66.249.90.104-66.249.90.108

IIRC it will distribute through the pool with each connection being mapped, so things should be evenly split. If you really need to control which requests go where, you could try running the multiple apache instances under different users and matching with separate rules.

Jeremy M
  • 819
  • 4
  • 10
0

Take a look at the Linux Advanced Routing and Traffic Control HOWTO, in particular at this page. Perhaps you want to leave routing to the kernel, which knows about it, than to apache, which is taking care of the "application" level.

lorenzog
  • 2,799
  • 3
  • 20
  • 24