0

I want my Glassfish webserver to serve web pages for two distinct IP addresses. What I am trying to do is to setup iptable rules to translate the ports.

for IP #1

198.xxx.xxx.14:80   <-- redirected to --> port 8080
198.xxx.xxx.14:443  <-- redirected to --> port 8181

for IP #2

199.xxx.xxx.185:80  <-- redirected to --> port 9090
199.xxx.xxx.185:443 <-- redirected to --> port 9191

and then, on my Glassfish server, I would have two virtual servers:

  • one listening to ports 8080 & 8181 for all hosts and
  • the other one listening to ports 9090 & 9191 for all hosts.

My working iptables rules for only one IP address on my Debian server are as follows :

iptables -t nat -A OUTPUT -o lo -p tcp --dport 80 -j REDIRECT --to-port 8080
iptables -t nat -A OUTPUT -o lo -p tcp --dport 443 -j REDIRECT --to-port 8181
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8181

My /etc/hosts file contains the two IP addresses :

...
198.xxx.xxx.14 subdomain.mydomain1.com myservername1
127.0.0.1 localhost.localdomain localhost
# Auto-generated hostname. Please do not remove this comment.
199.xxx.xxx.185 mydomain2.org  myservername2

and the /etc/network/interfaces already contains the network adapters binding, as follows :

...
auto venet0:0
iface venet0:0 inet static
    address 199.xxx.xxx.185
    netmask 255.255.255.255

auto venet0:6
iface venet0:6 inet static
    address 198.xxx.xxx.14
    netmask 255.255.255.255
...
1
iptables -t nat -A PREROUTING -p tcp -m tcp -d 198.xxx.xxx.14 --dport 80 -j REDIRECT --to-ports 8080
iptables -t nat -A PREROUTING -p tcp -m tcp -d 198.xxx.xxx.14 --dport 443 -j REDIRECT --to-ports 8181
iptables -t nat -A PREROUTING -p tcp -m tcp -d 198.xxx.xxx.185 --dport 80 -j REDIRECT --to-ports 9090
iptables -t nat -A PREROUTING -p tcp -m tcp -d 198.xxx.xxx.185 --dport 443 -j REDIRECT --to-ports 9191

This will take care of incoming traffic from other hosts. For local access, I recommend removing the OUTPUT rules altogether and using the real port numbers to avoid ambiguity. Or just pick which two ports you wish to reach when you connect to 127.0.0.1:80 or 127.0.0.1:443, and set the two OUTPUT rules for them.

Not the answer you're looking for? Browse other questions tagged or ask your own question.