The configurations of the client, proxy server, and backend server are as follows: CIP (client IP address): 192.168.189.149, VIP (proxy server IP address): 172.19.222.16, and RIP (back-end intranet server IP address): 192.100.13.203.

Config the iptables proxy at proxy server:

  1. iptables -A PREROUTING -p tcp -d 172.19.222.16 -j DNAT --to 192.100.13.203.
  2. iptables -A POSTROUTING -j MASQUERADE.

Req message ip changed by reverse proxy, Rsp message reply network process as below: Req msg: Client(CIP 192.168.189.149->VIP 172.19.222.16) ==> proxy server_iptables(VIP 172.19.222.16->RIP 192.100.13.203) ==> RealServer Rsp msg:RealServer(RIP 192.100.13.203->VIP 172.19.222.16) => proxy server_iptables(VIP 172.19.222.16->CIP 192.168.189.149) question here ==> Client

Question: The destination address of the reply message sent by the real server is not the IP address of the client, and the reverse proxy server is not informed of the final address (IP address of the client) of the message. How does the reverse proxy server know that this message should forwards to the client? Is it because there has flow table stored in iptables module, or some other way?

Detail proxy of request and reply message as below:

  1. The client sends a message to the proxy server. The proxy server forwards the message to the IP address of the real server based on the DNAT rule, changes the source IP address to the IP address of the proxy server, and routes the message.
  2. The real server receives the message from the reverse proxy server. The source IP address of the message is the IP address of the proxy server, and the destination IP address is the IP address of the real server.
  3. The real server sends a request message to the reverse proxy server. The source IP address is the IP address of the real server, and the destination IP address is the IP address of the reverse proxy server.
  4. After proxy server receive the reply message, it will forwards the message to the client. The destination address of the message sent by the real server is not the IP address of the client, and the reverse proxy server don't know reply message final address (IP address of the client). How does the reverse proxy server know that this message should forwards to the client? Is it because there has flow table stored in iptables module, or some other way?
0

There are 0 best solutions below