Though some ISPs override DNS TTL, and the Microsoft IE browser itself also does this. If it is business critical then a PF router can indeed easily do this to catch the few cases where the old server is still being used.
Kind regards, Fredrik Widlund -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jason Dixon Sent: den 10 september 2008 13:14 To: Fubar Cc: PF List Subject: Re: Reality check On Wed, Sep 10, 2008 at 05:37:24PM +1000, Rod Whitworth wrote: > I'm suffering from sleep deprivation today so benzedrine.cx sounds > inviting ;-) > > Anyway a friend has a problem and I'd like a check on the sanity of my > hazy proposed solution. > > All addresses are fictitious. > > X has a webserver which has address 1.2.3.4 He wants to change his > hosting to another provider where a new server will be given address > 5.6.7.8 > > The time of changeover is not entirely under X's control but the > domain's DNS is. > > X would like all traffic to proceed to/from 1.2.3.4 until 5.6.7.8 is > ready and then switch with absolutely minimal downtime. Of course.. > > My foggy brain says that it should be possible to use a box running pf > to route requests arriving on one external interface (say 9.8.7.6) out > another one (we have enough spare IPs on separate netblocks) to 1.2.3.4 > until cut-over time and then pf.conf swaps to sending it to 5.6.7.8. > > If we put 9.8.7.6 into the DNS as the webserver address we should be > able to transparently route the traffic to whichever real webserver we > wish .......... I think. > > Then when all is stable we swap the DNS records to point to 5.6.7.8 and > when no more traffic is seen to pass through our "black box router" we > dispense with it. > > Will this scheme work? Do I need to use binat? (all addresses are > global) does it matter if the webserver answers client requests and the > traffic does not come back via the black box? This is silly. Just lower your DNS TTL and change your records whenever the new box is up and ready for traffic. Once your TTL has expired (old one + new one) then you're guaranteed all requests are hitting the new server. Watching logs (as another reply suggested) doesn't work because you never know when that last request will hit (unless you're managing your TTL). -- Jason Dixon DixonGroup Consulting http://www.dixongroup.net/
