views:

585

answers:

3

I'm running an ubuntu jaunty server with 2 network interfaces configured: one public IP, one private. When I request the server IP I get the public IP. If I've got multiple interfaces is there a best practice for assuring I'm getting the public one (which is what I want)?

<?php
echo " <table>";
echo "<tr><td>" .$_SERVER['SERVER_ADDR'] ."</td><td>SERVER_ADDR</td></tr>";
echo "<tr><td>" .$_SERVER['SERVER_NAME'] ."</td><td>SERVER_NAME</td></tr>";
echo " </table>";
?>
A: 

I think this is handled by Apache when you set up your domains. Apache recommends using a separate daemon per ip to keep them straight: http://httpd.apache.org/docs/1.3/vhosts/ip-based.html

Create a separate httpd installation for each virtual host. For each installation, use the Listen directive in the configuration file to select which IP address (or virtual host) that daemon services. e.g.

`Listen www.smallco.com:80`

It is recommended that you use an IP address instead of a hostname (see DNS caveats).

OR

You could probably use your /etc/hosts file to ensure that the hostname you choose always resolves to the desired ip. See: http://www.faqs.org/docs/securing/chap9sec95.html for info on /etc/hosts.

willoller
If www.smallco.com resolves internally to the internal IP and externally to the public IP he'll still get two different IPs according to where the traffic comes from
Vinko Vrsalovic
Oh yes I see then the Listen directive wouldn't work even if you used an IP instead of a hostname, you would just get a Server Not Found, right?
willoller
No, if you use an IP you'd get the default VirtualHost
Vinko Vrsalovic
+1  A: 

My impression is that you'll get the address of wherever the traffic is coming in from, so if you want to always act with regard to the public interface regardless of where your request came from, you'll have to disregard $_SERVER['SERVER_ADDR'] and determine the IP you want to deal with in code (hardcoding it, analyzing the interface table and looking for something that isn't on a private network, what-have-you).

chaos
This was exactly the problem. I neglected to consider haproxy in front of the two web servers. All the traffic to those web servers arrives from haproxy over the private network interface. Because the traffic is coming over the private network, it responds with the private IP for SERVER_ADDR. If I hit the web server directly, it responds with the public IP. I knew it would be something simple I was overlooking and needed an extra brain on it.
Michael Marano
A: 

You should always get the public IP from the public and the private IP from the people in your private network. There is no sane way of assuring you'll always get the public IP nor it makes sense to

Vinko Vrsalovic