2

Environment: Web server that requests pages on a specific port from an application server.

Problem: If a page request comes into the application server during the restart of a certain web application running on the application server, the start up gets corrupted.

Question: Is it possible to include some kind of block on the specific port (or redirect) in the beginning of the shell script that starts the web application? This would have to work "on the fly" and of course be reversed at the end of the shell script so that once the application was up and running, the requests would flow normally.

0

On the app server machine:

Before starting up the app:

iptables -I INPUT -d <app server ip> --dport <app server port> -j REJECT

After startup completed:

iptables -D INPUT -d <app server ip> --dport <app server port> -j REJECT

If you want, you can alternatively redirect the traffic to another server that would say "app is loading". If that's the case, replace:

-j REJECT

with

-j DNAT --to-destination <ip address of other machine>

on both of the commands. Note that you'ld need IP Forwarding enabled if you do that. Need to configure:

net.ipv4.ip_forward = 1

in /etc/sysctl.conf

That would take effect on next boot. To apply on the running system immediately:

echo 1 > /proc/sys/net/ipv4/ip_forward

You might also need to masquerade traffic leaving your app server towards the server, to seem to the receiving server as originating from it (i.e. re-write the source IP address). You can do that by:

iptables -t nat -I POSTROUTING -o <interface traffic will get out> -j MASQUERADE

Another option is that if you have another server on the very same machine as the app server, in a different port, that can display the "app is loading page", you could redirect the traffic to that port. Same idea, just instead of REJECT/DNAT:

-j REDIRECT --to-port <other local server port number>

This option does not require converting your app server into a router :) (ip_forward not required)

  • Works for Linux (where iptables is), but not for me (SunOS 5.10). But since the question didn't say anything about what flavor of unix, I gave it a check mark. coombs.anu.edu.au/~avalon is where one may find "IP Filter", which might do the same thing. – Dale Sep 16 '13 at 13:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.