Looks fine to me:

`rtucker@witte:~$ curl http://176.58.107.88/test.jsp

Java Version:1.6.0_22

Local name:www.joli-ciel.com

Server name:176.58.107.88

Local IP:178.79.152.69

rtucker@witte:~$ curl http://178.79.152.69/test.jsp

Java Version:1.6.0_22

Local name:www.joli-ciel.com

Server name:178.79.152.69` 

`Local IP:178.79.152.69` 

No - that's precisely the problem.

You get the same Local IP and Local Name in both cases:

Local IP:178.79.152.69

Local name:www.joli-ciel.com

Only the server name is different.

What should appear is for 176.58.107.88 is:

Java Version:1.6.0_22

Local name:www.moyshele.com

Server name:176.58.107.88

Local IP:176.58.107.88

What does appear (exactly the same as for http://www.joli-ciel.com except for the Server Name):

Java Version:1.6.0_22

Local name:www.joli-ciel.com

Server name:176.58.107.88

Local IP:178.79.152.69

edit: I'm wrong, sorry

@glg:

getLocalName and getLocalAddr do not do what you think they do. they look at the local machine, not where the request came to
That's unfortunate, because that's what Tomcat uses to resolve the IP address when you tell the connector to do so.

From v6.0.35 source code, org/apache/catalina/connector/CoyoteAdapter.java, line 489:

        if (connector.getUseIPVHosts()) {
            serverName = req.localName();

However, when I dig deeper into the source code to where the request's local name is getting set in the first place, it's being set from socket.getLocalAddress(), on org/apache/catalina/http11/Http11Processor.java, line 1063.

Now, according to the java 6.0 javadoc at http://docs.oracle.com/javase/6/docs/ap … ress%28%29">http://docs.oracle.com/javase/6/docs/api/java/net/Socket.html#getLocalAddress%28%29, Socket.getLocalAddress() "Gets the local address to which the socket is bound."

So, my interpretation of this is that this is where the request came to, not just some check as to the local machine's IP and name.

Otherwise, nobody would be able to get this solution working, which is, however, what is recommended by the Tomcat documentation.

http://tomcat.apache.org/tomcat-6.0-doc … unning_SSL">http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html#GeneralTipsonRunningSSL

"Finally, using name-based virtual hosts on a secured connection can be problematic."

If you do 'netstat -ntlp', what is the actual address to which it is bound?

@hoopycat:

If you do 'netstat -ntlp', what is the actual address to which it is bound?

sudo netstat -ntlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1967/sshd
tcp        0      0 127.0.0.1:5432          0.0.0.0:*               LISTEN      2082/postgres
tcp6       0      0 127.0.0.1:8005          :::*                    LISTEN      16815/java
tcp6       0      0 :::8080                 :::*                    LISTEN      16815/java
tcp6       0      0 :::22                   :::*                    LISTEN      1967/sshd
tcp6       0      0 176.58.107.88:8443      :::*                    LISTEN      16815/java
tcp6       0      0 178.79.152.69:8443      :::*                    LISTEN      16815/java

You don't seem to have anything bound to port 80…?! It shouldn't be working at all, that much is certain.

@hoopycat:

You don't seem to have anything bound to port 80…?! It shouldn't be working at all, that much is certain.

Sorry, that's because I have an IPTables rule mapping 8080 to 80 and 8443 to 443, since the tomcat6 account doesn't have access to ports below 1024. Here's the relevent portion:

*nat
:PREROUTING ACCEPT [11:3512]
:POSTROUTING ACCEPT [13:844]
:OUTPUT ACCEPT [13:844]
-A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8443 
-A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 
-A OUTPUT -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8443 
-A OUTPUT -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 
COMMIT

This is called within /etc/network/interfaces via the pre-up command as follows:

auto lo
iface lo inet loopback

auto eth0 eth0:0

iface eth0 inet static
 address 178.79.152.69
 netmask 255.255.255.0
 gateway 178.79.152.1
        pre-up iptables-restore < /etc/iptables.conf

iface eth0:0 inet static
 address 176.58.107.88
 netmask 255.255.255.0
        pre-up iptables-restore < /etc/iptables.conf

Hmm. If you connect straight to port 8080 instead of 80, does it work as expected?

@hoopycat:

Hmm. If you connect straight to port 8080 instead of 80, does it work as expected?

Using his links from the first post, yes. That means that the mapping ports via iptables is the culprit.

You're really not "supposed" to do it that way. You're "supposed" to use a "real" web server like apache with mod_jk or nginx in front of tomcat. and yes, that's all in quotes for a reason, tomcat will work just fine by itself, but occasionally you end up with a scenario like this.

You might be able to get the iptables to work by having multiple rules for each IP (ie instead of routing all 443 traffic to 8443, separately route ip1.443 to ip1.8443 and ip2.443 to ip2.8443)

Sorry about my previous post, I was off on how those functions work in the context.

@glg:

@hoopycat:

Hmm. If you connect straight to port 8080 instead of 80, does it work as expected?

Using his links from the first post, yes. That means that the mapping ports via iptables is the culprit.

…

You might be able to get the iptables to work by having multiple rules for each IP (ie instead of routing all 443 traffic to 8443, separately route ip1.443 to ip1.8443 and ip2.443 to ip2.8443)
Thanks hoopycat and glg! That solved it.

My iptables.conf file now looks like this:

-A PREROUTING -p tcp -m tcp --dst 178.79.152.69 --dport 443 -j DNAT --to-destination 178.79.152.69:8443
-A PREROUTING -p tcp -m tcp --dst 176.58.107.88 --dport 443 -j DNAT --to-destination 176.58.107.88:8443
-A PREROUTING -p tcp -m tcp --dst 178.79.152.69 --dport 80 -j DNAT --to-destination 178.79.152.69:8080
-A PREROUTING -p tcp -m tcp --dst 176.58.107.88 --dport 80 -j DNAT --to-destination 176.58.107.88:8080
-A OUTPUT -p tcp -m tcp --src 178.79.152.69 --dport 443 -j REDIRECT --to-ports 8443 
-A OUTPUT -p tcp -m tcp --src 176.58.107.88 --dport 443 -j REDIRECT --to-ports 8443 
-A OUTPUT -p tcp -m tcp --src 178.79.152.69 --dport 80 -j REDIRECT --to-ports 8080 
-A OUTPUT -p tcp -m tcp --src 176.58.107.88 --dport 80 -j REDIRECT --to-ports 8080

That being said, I don't quite understand the IPTables OUTPUT rows.

I would expect tomcat to be outputting on port 8443, and to be redirected to port 443, but the opposite is written above.

But that's a question for another thread!

Thanks again!

Assaf