UNIX for Advanced & Expert Users

Hi All,


Anyone here already done similar to the queries below ?

Is there is a way to have a setup that would allow an SA to easily hook any prod server (external ip) to an internal ip without network reconfigurations ?

Your comments here will be much appreciated.

Thanks

Investigate using ssh port forwards, any further elaboration will require a more detailed explanation of what you are wanting to do.

Hi Smiling Dragon,

Thanks.. I'm getting an idea from your reply.

Actually, the aim should be to be able to switch between the devices ( from external to internal network and vice versa) without requiring a maintenance window or risking other network connections. This is a requirement if server in prod will be tested via internal network.

Its quite weird but if we have a setup such this would be very helpful.

Ah, now I think I understand what you are after - I've implemented something similar in the past as a low budget proof of concept. If you want something more solid - stick with NAT rules on the routers but as a test case ssh tunnels should do the job for you.

You are still pretty light on the details so I'll suggest an example as it might help show the process:
Suppose you have 4 servers, 2 of which are customer facing webservers and 2 are back-end application servers. These servers operate in an active-standby mode where any pair of 2 servers (one webserver, one app server) are up and running while the other two are on standby. If the app itself is too stupid to handle this scenario, we can use ssh tunnels instead:
App server A opens a connection via ssh to webserver A and webserver B, it listens to the localhost loopback interface on some high port (use a high port so you don't need to trust an ssh as root on your webserver). Any traffic to these high ports is directed down the tunnel and to the back-end app server. Configure both webservers to connect to "back ends" on localhost:<high port>.
Traffic from either webserver will arrive at the app server automagically.

If you want to switch to the other app server (even if that's in a completly different network). You kill the ssh tunnels and reopen them from App Server B instead on the same high port. The webserver sees a brief connection loss but everything comes back right away and it carries on oblivious to the move.

You'll not be able to switch without outage at all, but the outage can be reduced to a few seconds at least this way and avoids config changes on the webservers.

Is that what you had in mind?

Hi Smiling Dragon,

I really appreciate your reply and i'm sorry if the details is a little bit lighter.

Actually the web servers are in Production with network 192.168.202.X for eth0 and 192.168.201.X for eth1 both are external network. We need it to be accessible from internal network 10.3.100.X if the test team will do the testing. The problem is every time the test group do the testing, SA will change the IP address first to make the server accessible from internal network.

We have 25 web servers having these external IPs.

So we are looking for a solution that would allow an SA to easily hook the prod server to an internal IP without network re-configurations.