Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a Load Balance set up in Apache httpd:

<VirtualHost *:80>
        DocumentRoot /var/www/html
        ServerName xxx.xxx.xxx.com
        ProxyRequests           Off
        ProxyPreserveHost       On
        ProxyPass / http://xxx.xxx.xxx.xxx:8080/
        ProxyPassReverse / http://xxx.xxx.xxx.xxx:8080/
</VirtualHost>

:8080 is an Apache tomcat application server running on the same host. We have log retention requirements where I work, so I figured making everything apache httpd would make things ideal for analytics.

I was attempting to get all public requests to go through port 80 without breaking any links or bookmarks end users might have. I was going to do that by doing some port translation so that everything looked like it was coming in via port 80 to applications. Without thinking about my load balance above I added the following rules to the nat table:

-A PREROUTING -i eth0 -p tcp -m tcp --dport 8080 -j REDIRECT --to-ports 80
-A PREROUTING -i eth0 -p tcp -m tcp --dport 8081 -j REDIRECT --to-ports 80

Which I'll admit was pretty dumb of me. Problem is, that I can get to the application either through httpd or directly by going to :8080. The packet count is also going up on each rule so apparently they're being matched against.

My question is this: Why didn't this just create an infinite loop?

It would seem the :8080 requests would get forwarded to httpd which would itself attempt to retrieve them by going over :8080 and thus the circle would continue onwards until I was reformatting my new resume.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

The answer lies in -i eth0.

Even though you have httpd set to connect to 17.98.65.28, which I assume is an IP on eth0, the traffic won't actually flow over eth0, it'll use lo instead.

The reason for this is that when routing to any IP the box has on itself, that traffic flows over lo. You can verify this with the following:

ip route get 17.98.65.28

You will get a line back that contains dev lo, this tells you which interface will be used to send traffic to that address.

For example, on my laptop, I have wlan0 with 10.252.28.62:

$ ip route get 10.252.28.62
local 10.252.28.62 dev lo  src 10.252.28.62 
    cache <local> 
share|improve this answer
    
Thanks for the quick response. –  Bratchley May 16 at 18:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.