Port Redirecting using xinetd.

[Nico van Royen]

Hi all,

I am using xinetd to redirect incomming requests on port 80 from one of my IP's (on a redhat box) to be redirected to a machine inside the intranet. So far so good.. the other machine (a webserver from a customer running apache). The problem is that the logging of the apache server only sees the 1st machine as 'source-ip', meaning web-traffic statistics are incomplete as they only show the firewall machine. Is there anyway (with xinetd or other way) to have the webserver machine see the REAL ip from the visitor?

The entry for xinetd used is:

service web
{
port = 80
bind = 212.26.219.29
socket_type = stream
protocol = tcp
user = root
redirect = 192.168.1.31 80
type = UNLISTED
wait = no
}

hardware setup:

machine 1 (internet connection):
eth0: 217.8.98.137 (internet)
eth1: 192.168.1.30 (internal)
eth2: 212.26.219.29 (internet, used for redirection)

machine 2 (just internal network)
eth0: 192.168.1.31

Thanks in advance...
-NvR

[U.SivaKumar_2]

Hi,
It is not possible to see real IP address of the visitor from apache logs as the xinetd acts as a proxy ( in other words port address
translation or NAT overload ).

Therefore the packets originationg from xinetd
server will have source IP of xinetd server and
destination IP of apache server. Now apache server will send the content to the xinetd server . xinetd server will take care of forwarding the content to the visitor. ( stateful port forwarding)

Only one solution to overcome this is to use xinetd logging option.


service web
{
port = 80
log_type = FILE /var/log/webaccess.log
log_on_success = PID HOST EXIT
bind = 212.26.219.29
socket_type = stream
protocol = tcp
user = root
redirect = 192.168.1.31 80
type = UNLISTED
wait = no
}

#touch /var/log/webaccess.log

Restart xinetd daemon

regards,
U.SivaKumar

[Nico van Royen]

This will log all visitors that browse pages on the webserver but as web-stats it can't be used. I guess we have to live with it.
Thanks anyway for the reaction.

- NvR

[Bill Thorsteinson]

Look at putting Apache on the machine you are forwarding from and using its proxy services to the machine on the intranet.

[Mark Bainter]

I agree with using Apache to proxy being an option, but unless you have need to run apache locally (which it doesn't sound like you do) I'd suggest setting up squid to handle this for you.