I think, if I understand correctly, and the machines are physically close, or is it a new path, then:
1. Tunneling is clearly unnecessary, think you can do a virtual proxy bridge for the car. (She will be standing physically in the context of backend and provider. )
2. In the proposed variant you don't have to reconfigure the backend, since the IP address will remain on it.
3. the filter is thus completely possible with iptables. (although I could be wrong, most still need ibtables, correct )
4. The solution is universal and will support any type of IP traffic
Patience_Roga answered on October 3rd 19 at 04:13
Why no one suggested HAProxy?
Works for me so
Client -> iptables -> haproxy -> backend
Depending on Your needs, you can configure haproxy to work from l3 to l7
kari.Halvorson answered on October 3rd 19 at 04:15
Filter server with one interface. Forwards the traffic to the processing server without SNAT.
The client must contact the server and filter the answer to get through it.
I.e. for the client, a processing server IP = IP filter. With appropriate DNS records (in the case of a web server).
To redirect traffic from the client to the processing — it's just DNAT. But that response went through the filter, on the processing server must be the main route to the filter. So, the filter and the server must be on the same subnet.
Probably easier just to do VPN from the frontend to the filter (or Vice versa, whichever is easier) and configure routes on both sides.
Oh, and for the protection to block the extra (almost all) on a normal interface, a processing server.
If you intend to only web traffic, then nginx + X-Forwarded-For. At the same time filtering any in nginx can be done. And it is possible and Squid(ω) to try to do. Still caching will get a gift.
kari.Halvorson answered on October 3rd 19 at 04:17
No, the machines are removed by the DC, not the path. The front-end exactly a dedicated server (win 2008), the tunnel — linux vps
Why not raise on win 2008 virtual machine with Linux, and all traffic to drive through the V-world?