Cdtjkyj

I have a Load Balance set up in Apache httpd:

<VirtualHost *:80>

        DocumentRoot /var/www/html

        ServerName xxx.xxx.xxx.com

        ProxyRequests           Off

        ProxyPreserveHost       On

        ProxyPass / http://xxx.xxx.xxx.xxx:8080/

        ProxyPassReverse / http://xxx.xxx.xxx.xxx:8080/

</VirtualHost>

:8080 is an Apache tomcat application server running on the same host. We have log retention requirements where I work, so I figured making everything apache httpd would make things ideal for analytics.

I was attempting to get all public requests to go through port 80 without breaking any links or bookmarks end users might have. I was going to do that by doing some port translation so that everything looked like it was coming in via port 80 to applications. Without thinking about my load balance above I added the following rules to the nat table:

-A PREROUTING -i eth0 -p tcp -m tcp --dport 8080 -j REDIRECT --to-ports 80

-A PREROUTING -i eth0 -p tcp -m tcp --dport 8081 -j REDIRECT --to-ports 80

Problem is, that I can get to the application either through httpd or directly by going to :8080. The packet count is also going up on each rule so apparently they're being matched against.

My question is this: Why didn't this just create an infinite loop?

It would seem the :8080 requests would get forwarded to httpd which would itself attempt to retrieve them by going over :8080 and thus the circle would continue onwards until I was reformatting my new resume.

The answer lies in -i eth0.

Even though you have httpd set to connect to 17.98.65.28, which I assume is an IP on eth0, the traffic won't actually flow over eth0, it'll use lo instead.

The reason for this is that when routing to any IP the box has on itself, that traffic flows over lo. You can verify this with the following:

ip route get 17.98.65.28

You will get a line back that contains dev lo, this tells you which interface will be used to send traffic to that address.

For example, on my laptop, I have wlan0 with 10.252.28.62:

$ ip route get 10.252.28.62

local 10.252.28.62 dev lo  src 10.252.28.62 

    cache <local>