2

I've done a lot of searching on Google and browsed what I could find on Server Fault, but can't find any solution to this.

I have a server that is running LXC containers (2 for right now, both Ubuntu). The LXC network is bridged (10.0.3.0/24), with the DHCP server for it being at 10.0.3.1, and I'm using two IPs of that network: 10.0.3.2 (container 1 [CN1]) and 10.0.3.3 (container 2 [CN2]).

I have Apache set up on both, and I have a subdomain set up on DNS for a website of mine that points to my public IP (web1 -> CN1 and web2 -> CN2). The subdomains resolve correctly, but here is where the problem starts.

Depending on which rule I have first in iptables determines which container is hit with the webpage. So if I have external port 80 hit CN1 first, then that index.html file is shown, and if 80 is set for CN2 first, then that index.html file is shown.

What I thought I'd do is set the Apache servers to listen on a different port, so I set CN1 to listen on 801 and CN2 to listen on 802, then I set up iptables to route route external port 80 to both of these, but the same issue still arises.

My ultimate goal is to have web1 and web2 display their respective index.html files without specifying a specific external port (i.e.: ip:81->CN1 and ip:82->CN2). Only other thing I can think of is set up a proxy (i.e.: nginx) on the host and have it proxy requests based on the (sub)domain requested, but I'd rather not do that if possible.

iptables rules:

NAT table

root@SKYNet:~# iptables -t nat -L  
Chain PREROUTING (policy ACCEPT)  
target     prot opt source               destination  
DNAT       tcp  --  anywhere             anywhere             tcp dpt:http to:10.0.3.2:801
DNAT       tcp  --  anywhere             anywhere             tcp dpt:http to:10.0.3.3:802

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  10.0.3.0/24          anywhere

Default table

root@SKYNet:~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

I do understand the logic of iptables and routing it to one point, but I thought iptables would basically try to direct the packet to port 801, and if it doesn't match the VHost it'll reject it and iptables will go to the next one (802 in this case).

tombull89
  • 2,964
  • 8
  • 41
  • 52
Eric Hansen
  • 33
  • 4

2 Answers2

2

iptables is doing its job. iptables has no idea of what is HTTP if your targeting the same port, only the first rule will match whatever happens to the request afterwards.

The only way to achieve what you need is to setup a reverse proxy which will get all HTTP requests and redirect them to the correct HTTP server depending on the host name.

Spack
  • 1,604
  • 15
  • 22
  • So basically do what I really didn't want to do and set up a proxy on the host machine that handles the redirects instead of working on it from iptables? Not a big deal for me if that's what you mean, I can do it, it'd just take some extra management from my end. – Eric Hansen May 26 '13 at 14:58
  • Yes that's what I mean. It's not very complex to set up. – Spack May 26 '13 at 15:01
  • Not really, just I'm lazy and wanted to do it the easiest way possible, lol. But regardless I'll work on the proxy and go from there, thanks! – Eric Hansen May 26 '13 at 15:02
0

You need a proxy to do this. IPtables will just redirect packets that match this rule - it won't check if it goes anywhere, or if any ICMP port-unreachables are returned. Even if it did however, this still wouldn't work - you won't get any failures IPtables will know about, because the only failure will be a layer 7 one. The actual TCP handshake (which is the bit iptables cares about) will be completed successfully by the time that happens.

Cian
  • 5,838
  • 1
  • 28
  • 40
  • If I could I'd mark both you and Spack as accepted answers but can't. Thanks for the information. I kinda figured that's what was happening, I was just not wanting to face reality is all lol. – Eric Hansen May 26 '13 at 15:03