15

We use a (poorly-designed) application that requires the IP address of our corporate office which has a static public IP address. However, when our failover internet kicks in, it obviously has a different static public IP address and then remote connections fail.

If the application would accept a domain name, I would use that with dynamic DNS, but it doesn't accept a domain name.

Is there any way to input an IP address but get to our domain name? I had two thoughts that I haven't tried yet.

  1. Set up a local IP address that redirects to our domain name (e.g. 10.0.1.99 goes to local.ourdomain.com). However, I'm not quite sure how I would do this. Set up a Raspberry Pi with a web server maybe.

  2. Purchase web hosting with a dedicated IP address and have it redirect to our domain which then could get updated as needed.

Any thoughts on how to achieve this?

  • 1
    What kind of application? You mean something hosted internally? Like some kind of Ruby or Java or even JavaScript framework? – JakeGould Dec 4 '17 at 2:54
  • 1
    Reverse proxy. Stick it at a fixed address and have it forward packets to the appropriate address. – Ignacio Vazquez-Abrams Dec 4 '17 at 2:55
  • Just a Windows program that a vendor has provided to us which sends and retrieves data from our corporate office. – MrPeanut Dec 4 '17 at 2:56
  • 2
    You’re going to have to host a reverse proxy somewhere with an IP address that never changes. That will cost money. Have you considered just moving the service to the cloud where redundancy is built in anyways? The cost is probably similar. The other suggestion of using a VPN makes a lot of sense. I don’t see how a reverse proxy is a good solution to this at all. – Appleoddity Dec 4 '17 at 5:51
  • 1
    @Appleoddity The reverse proxy is simply the implementation of bullet point 1 of the OP. You don't have the raspberry in the corporate office but in the local network where the application is being run. Since that's feasible in the given scenario according to the OP, it's probably the simplest and cheapest solution. – Voo Dec 4 '17 at 13:49
37

A reverse proxy is a good idea, but may be limited by protocol.

I'd solve this problem by setting up a VPN (which provides security - if the app is that badly written it does not do a DNS lookup it's probably not using decent crypto either). Using a VPN means your addresses can all be rfc1918 ( ie private ones ), and the app won't even care when the external addresses change.

0

A VPN is sort of expensive when you could get a Raspberry Pi or Pi Zero and run Debian on it, and set up iptables on it to masquarade the way you want

Details would depend on how you local network was set up, but the general idea would be to give the Pi two fixed local addresses.

One address would be reserved for administering the Raspberry Pi. That's how you'd ssh in and alter things if needed.

The other would act as proxy for the remote primary (or backup).

Packets sent to THAT address could get forwarded using iptables as a masquerade to the primary or to the fallback depending on conditions. NAT would alter the packet's source and destination addresses as needed before re-transmission.

Packets returning get NATed back to the requester.

This should work fine as long as there are no IP addresses embedded deeper in the packets, or cases like classic FTP that establish parallel connections.

Bonus points if you can make the Pi notice that the primary site has vanished and automagically switch to the backup

  • I run a vpn for free, i dont see why he couldn't. He isnt hiding his traffic from his ISP. OPENvpn – FreeSoftwareServers Dec 5 '17 at 9:50
-4

Use Route53 (amazon) or any other dns which has a fallback routing. If you use health checks, you can assign a secundairy DNS entry IP when your health check fails on the primary IP.

  • 7
    How does this help if the application won't resolve a DNS record? – ydaetskcoR Dec 4 '17 at 11:14
  • you will check the primary internet IP so NOT the device IP. the primairy internet IP has to resolve. when it does not, this means you need a failover. – Ramon Fincken Dec 4 '17 at 12:01
  • @Ramon Considering that the application never uses the DNS record, how exactly would adapting the DNS record help? – Voo Dec 4 '17 at 12:45
  • 4 IPs: A primary internet IP, B fallback internet IP, C the device IP, D the device fallback IP you will health check ip A and return ip C for the device. if A goes down, return ip D – Ramon Fincken Dec 4 '17 at 14:01
  • 1
    @Ramon The application has hardcoded in some configuration "connect to IP A.B.C.D", the exact problem is that it is not asking which IP it should use. Or is the idea that they should run the application multiple times for each server IP and then switch applications? That could work assuming there's no licensing problems and it's possible to configure the applications to share stored state and there's no problem with running multiple applications with the same storage at the same time (this seems very unlikely for the vast majority of applications). – Voo Dec 4 '17 at 15:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.