Discussion:
proxy with a specific source IP?
Geff
2004-04-29 20:44:13 UTC
Permalink
All,

I've done quite a bit of reading looking for config options to do what I want
and I haven't found anything. Do any of you know if something like this can be
done, or if I should try to write "hack/patch". If nothing exists, would anyone
find this feature useful? What module would be the best place for this type of
feature?

Given a proxy server with 4 IPs:

A - VirtualHost1
B - VirtualHost2
C - SourceIP1
D - SourceIP2

And two destination servers:

E - Dest1
F - Dest2

And given a proxy config that listens on A and B and proxies to E and F, I would
like the connection to the destination servers (E & F) to be placed from IPs C
and D respectfully. Is that possible?

I guess what I'm looking for is a ProxyPass directive that allows me to specify
the source IP to use when connecting to the remote server.

So perhaps a table of what we desire:

ProxyVirtualHostIP ProxySourceIP DestinationServer
A C E
B D F

Does an option like this exist? Would it be best implemented in mod_proxy or is
there another module that takes care of IP connections with other hosts that
could be used? We would like to use it so that we may source route certain
requests over different firewalls. So think about 3 sites: gold, silver,
bronze. Where all would share one set of RPs, but not the same set of
firewall/router infrastructure. So the routers would do source based routing
and direct the traffic through the proper firewall. I'm sure many of you think
this is as much overkill as I do. :) You know how that goes....

Thanks for your help and help,

Geff
Carsten Gaebler
2004-04-29 21:12:52 UTC
Permalink
Post by Geff
I guess what I'm looking for is a ProxyPass directive that allows me to specify
the source IP to use when connecting to the remote server.
ProxyVirtualHostIP ProxySourceIP DestinationServer
A C E
B D F
I guess this can't be done with mod_proxy but you could configure your
routing table like this:

ip route add E dev eth0 src C
ip route add F dev eth0 src D

At least this is how it works on Linux provided that eth0 holds C and D.
Note that this applies to *all* connections to E and F, not only
those originating from Apache.

Hope this helps.

cg.
b***@boing.com
2004-04-29 21:18:11 UTC
Permalink
Post by Carsten Gaebler
Post by Geff
ProxyVirtualHostIP ProxySourceIP DestinationServer
A C E
B D F
ip route add E dev eth0 src C
ip route add F dev eth0 src D
At least this is how it works on Linux provided that eth0 holds C and D.
Note that this applies to *all* connections to E and F, not only
those originating from Apache.
Hope this helps.
Wow, yes thanks! Now if only we weren't running solaris. :) That's definitely
an option tho, I really appreciate the feedback.

Geff
Richard Birkett
2004-06-05 16:31:15 UTC
Permalink
Post by Geff
I've done quite a bit of reading looking for config options to do what I want
and I haven't found anything. Do any of you know if something like this can be
done, or if I should try to write "hack/patch".
I've just submitted (as 'bug' 29404) a patch I've been using successfully
for a few years now.

There was also a brief discussion on this list back in November, with a
partial patch which changed the proxy source address to be the same as the
enclosing VirtualHost's listen address.

My patch adds a new per-VirtualHost configuration directive
ProxySourceAddress, which takes a single IP address. This needs to be an
existing interface address on the local machine, of course, otherwise the
bind() call will fail. It'll accept any format understood by
apr_sockaddr_info_get(), including a hostname, although that's probably to
be discouraged for performance reasons if nothing else (and it may not do
what you expect if a hostname resolves to more than one IP address!).
Post by Geff
A - VirtualHost1
B - VirtualHost2
C - SourceIP1
D - SourceIP2
E - Dest1
F - Dest2
And given a proxy config that listens on A and B and proxies to E and F, I would
like the connection to the destination servers (E & F) to be placed from IPs C
and D respectfully. Is that possible?
With the patch, your setup could be configured as follows:

<VirtualHost A>
ProxySourceAddress C
ProxyPass / http://E/
</VirtualHost>

<VirtualHost B>
ProxySourceAddress D
ProxyPass / http://F/
</VirtualHost>


Share+enjoy :)

Richard
Geff
2004-06-07 20:41:41 UTC
Permalink
Post by Richard Birkett
<VirtualHost A>
ProxySourceAddress C
ProxyPass / http://E/
</VirtualHost>
<VirtualHost B>
ProxySourceAddress D
ProxyPass / http://F/
</VirtualHost>
All,

Wow, that's great. Any chance of getting that included in the main dist?

Does that patch work in 2.0 and 1.3?

Geff
Richard Birkett
2004-06-08 18:20:01 UTC
Permalink
Post by Geff
Does that patch work in 2.0 and 1.3?
It should apply cleanly to recent checkouts of 2.0 (with a few lines
offset).

The 1.3 version is a little different because some of the ap_* structures
and methods changed between 1.3 and 2.0. I've not maintained it since I
switched to using 2.0 in 2002, so it may be a bit crufty, but I've just
resynced the changes against the 1.3 CVS HEAD and uploaded the diff (same
'bug' in Bugzilla, 29404).

Richard
Geff
2004-06-08 18:24:20 UTC
Permalink
Post by Richard Birkett
It should apply cleanly to recent checkouts of 2.0 (with a few lines
offset).
Thanks much. More reason to go to 2.0 :).

Geff
Richard Skeggs
2004-06-09 10:53:16 UTC
Permalink
I am using apache2 to try and map

http://eghapp/esav to http://eghsnap1:8081/esav
http://eghapp/ddrint to http://eghsnap2:8081/ddrint

In isolation both maps work as expected but when I try and set up both
together the problem I am faced with is that only the first map works
successfully. My problem is I need to set up a two more of these mapping.
Below is an extract from my httpd.conf file.


Httpd.conf extract

NameVirtualHost 10.14.1.150

<virtualhost 10.14.1.150>
DocumentRoot "/usr/local/apache2/htdocs"
ProxyPassReverse /esav http://eghsnap1:8081/esav
ProxyPass /esav http://eghsnap1:8081/esav
servername www.emeademo.mobius.com
serverpath /esav/
</virtualhost>

<virtualhost 10.14.1.150>
DocumentRoot "/usr/local/apache2/htdocs"
ProxyPassReverse /ddrint http://eghsnap2:8081/ddrint
ProxyPass /ddrint http://eghsnap2:8081/ddrint
servername www.emeademo.mobius.com
serverpath /ddrint/
</virtualhost>

Thanks

Richard


-----Original Message-----
From: Geff [mailto:***@pier64.com]
Sent: 08 June 2004 19:24
To: modproxy-***@apache.org
Subject: Re: proxy with a specific source IP?
Post by Richard Birkett
It should apply cleanly to recent checkouts of 2.0 (with a few lines
offset).
Thanks much. More reason to go to 2.0 :).

Geff
Geff
2004-06-09 14:00:16 UTC
Permalink
Since I don't understand what you're trying to accomplish perhaps I'm completely
off base here, but why don't you want:

<virtualhost 10.14.1.150>
DocumentRoot "/usr/local/apache2/htdocs"
ProxyPassReverse /esav http://eghsnap1:8081/esav
ProxyPass /esav http://eghsnap1:8081/esav
ProxyPassReverse /ddrint http://eghsnap2:8081/ddrint
ProxyPass /ddrint http://eghsnap2:8081/ddrint
servername www.emeademo.mobius.com
</virtualhost>

instead of what you have? I wasn't aware that you could define a virtual host
twice.

Geff
Post by Richard Skeggs
I am using apache2 to try and map
http://eghapp/esav to http://eghsnap1:8081/esav
http://eghapp/ddrint to http://eghsnap2:8081/ddrint
In isolation both maps work as expected but when I try and set up both
together the problem I am faced with is that only the first map works
successfully. My problem is I need to set up a two more of these mapping.
Below is an extract from my httpd.conf file.
Httpd.conf extract
NameVirtualHost 10.14.1.150
<virtualhost 10.14.1.150>
DocumentRoot "/usr/local/apache2/htdocs"
ProxyPassReverse /esav http://eghsnap1:8081/esav
ProxyPass /esav http://eghsnap1:8081/esav
servername www.emeademo.mobius.com
serverpath /esav/
</virtualhost>
<virtualhost 10.14.1.150>
DocumentRoot "/usr/local/apache2/htdocs"
ProxyPassReverse /ddrint http://eghsnap2:8081/ddrint
ProxyPass /ddrint http://eghsnap2:8081/ddrint
servername www.emeademo.mobius.com
serverpath /ddrint/
</virtualhost>
Thanks
Richard
-----Original Message-----
Sent: 08 June 2004 19:24
Subject: Re: proxy with a specific source IP?
Post by Richard Birkett
It should apply cleanly to recent checkouts of 2.0 (with a few lines
offset).
Thanks much. More reason to go to 2.0 :).
Geff
Graham Leggett
2004-06-09 14:39:11 UTC
Permalink
Post by Richard Skeggs
I am using apache2 to try and map
http://eghapp/esav to http://eghsnap1:8081/esav
http://eghapp/ddrint to http://eghsnap2:8081/ddrint
<virtualhost 10.14.1.150>
DocumentRoot "/usr/local/apache2/htdocs"
ProxyPassReverse /esav http://eghsnap1:8081/esav
ProxyPass /esav http://eghsnap1:8081/esav
servername www.emeademo.mobius.com
serverpath /esav/
</virtualhost>
<virtualhost 10.14.1.150>
DocumentRoot "/usr/local/apache2/htdocs"
ProxyPassReverse /ddrint http://eghsnap2:8081/ddrint
ProxyPass /ddrint http://eghsnap2:8081/ddrint
servername www.emeademo.mobius.com
serverpath /ddrint/
</virtualhost>
You have just configured two identical virtual hosts, the first one is
going to work, the second one is going to be ignored.

What you want to do is this:

<virtualhost 10.14.1.150>

DocumentRoot "/usr/local/apache2/htdocs"
servername www.emeademo.mobius.com

ProxyPassReverse /esav http://eghsnap1:8081/esav
ProxyPass /esav http://eghsnap1:8081/esav

ProxyPassReverse /ddrint http://eghsnap2:8081/ddrint
ProxyPass /ddrint http://eghsnap2:8081/ddrint

</virtualhost>

Regards,
Graham
--

Richard Skeggs
2004-06-09 14:17:41 UTC
Permalink
Billiant...thanks a lot that is it works beautifully

Thank you

Richard


-----Original Message-----
From: Geff [mailto:***@pier64.com]
Sent: 09 June 2004 15:00
To: modproxy-***@apache.org
Subject: Re: FW: proxy with a specific source IP?


Since I don't understand what you're trying to accomplish perhaps I'm
completely off base here, but why don't you want:

<virtualhost 10.14.1.150>
DocumentRoot "/usr/local/apache2/htdocs"
ProxyPassReverse /esav http://eghsnap1:8081/esav
ProxyPass /esav http://eghsnap1:8081/esav
ProxyPassReverse /ddrint http://eghsnap2:8081/ddrint
ProxyPass /ddrint http://eghsnap2:8081/ddrint
servername www.emeademo.mobius.com
</virtualhost>

instead of what you have? I wasn't aware that you could define a virtual
host twice.

Geff
Post by Richard Skeggs
I am using apache2 to try and map
http://eghapp/esav to http://eghsnap1:8081/esav http://eghapp/ddrint
to http://eghsnap2:8081/ddrint
In isolation both maps work as expected but when I try and set up both
together the problem I am faced with is that only the first map works
successfully. My problem is I need to set up a two more of these
mapping. Below is an extract from my httpd.conf file.
Httpd.conf extract
NameVirtualHost 10.14.1.150
<virtualhost 10.14.1.150>
DocumentRoot "/usr/local/apache2/htdocs"
ProxyPassReverse /esav http://eghsnap1:8081/esav
ProxyPass /esav http://eghsnap1:8081/esav
servername www.emeademo.mobius.com
serverpath /esav/
</virtualhost>
<virtualhost 10.14.1.150>
DocumentRoot "/usr/local/apache2/htdocs"
ProxyPassReverse /ddrint http://eghsnap2:8081/ddrint
ProxyPass /ddrint http://eghsnap2:8081/ddrint
servername www.emeademo.mobius.com
serverpath /ddrint/
</virtualhost>
Thanks
Richard
-----Original Message-----
Sent: 08 June 2004 19:24
Subject: Re: proxy with a specific source IP?
Post by Richard Birkett
It should apply cleanly to recent checkouts of 2.0 (with a few lines
offset).
Thanks much. More reason to go to 2.0 :).
Geff
Geff
2004-06-09 14:18:40 UTC
Permalink
Post by Richard Skeggs
Billiant...thanks a lot that is it works beautifully
^^^^^^^^^^^

First time for everything. :)

Enjoy, glad I could help.

Geff
Post by Richard Skeggs
Thank you
Richard
-----Original Message-----
Sent: 09 June 2004 15:00
Subject: Re: FW: proxy with a specific source IP?
Since I don't understand what you're trying to accomplish perhaps I'm
<virtualhost 10.14.1.150>
DocumentRoot "/usr/local/apache2/htdocs"
ProxyPassReverse /esav http://eghsnap1:8081/esav
ProxyPass /esav http://eghsnap1:8081/esav
ProxyPassReverse /ddrint http://eghsnap2:8081/ddrint
ProxyPass /ddrint http://eghsnap2:8081/ddrint
servername www.emeademo.mobius.com
</virtualhost>
instead of what you have? I wasn't aware that you could define a virtual
host twice.
Geff
Post by Richard Skeggs
I am using apache2 to try and map
http://eghapp/esav to http://eghsnap1:8081/esav http://eghapp/ddrint
to http://eghsnap2:8081/ddrint
In isolation both maps work as expected but when I try and set up both
together the problem I am faced with is that only the first map works
successfully. My problem is I need to set up a two more of these
mapping. Below is an extract from my httpd.conf file.
Httpd.conf extract
NameVirtualHost 10.14.1.150
<virtualhost 10.14.1.150>
DocumentRoot "/usr/local/apache2/htdocs"
ProxyPassReverse /esav http://eghsnap1:8081/esav
ProxyPass /esav http://eghsnap1:8081/esav
servername www.emeademo.mobius.com
serverpath /esav/
</virtualhost>
<virtualhost 10.14.1.150>
DocumentRoot "/usr/local/apache2/htdocs"
ProxyPassReverse /ddrint http://eghsnap2:8081/ddrint
ProxyPass /ddrint http://eghsnap2:8081/ddrint
servername www.emeademo.mobius.com
serverpath /ddrint/
</virtualhost>
Thanks
Richard
-----Original Message-----
Sent: 08 June 2004 19:24
Subject: Re: proxy with a specific source IP?
Post by Richard Birkett
It should apply cleanly to recent checkouts of 2.0 (with a few lines
offset).
Thanks much. More reason to go to 2.0 :).
Geff
Loading...