wouldn't it make sense to use a lower end system as your iptables gw / fw? i mean hardware is cheap, and iptables has
noproblems forwarding web traffic to a httpd on the iternal network that where postgres lives. why even open the
databaseup to the general internet population when the httpd only needs to talk to it.
dan
* Dan Ostrowski (dan@triad-dev.com) wrote:
> Hello all...
>
> I am developing a databasing system that will be used localy, but in tandem with a hosted web server.
>
> As such, I will be implementing a local PostgreSQL server and connecting it to the internet. However, this machine (
unfortunately) will probably also have to run the firewall as well, but that's all it will be more than likely..
databaseand firewall.
>
> Ideally, I would be able to send a "REJECT" message ( via iptables ) if the connection is refused because the
Databaseis down or somesuch, instead of just "DROP"ing the connection. This would speed up things for the web scripts
whenthe DB is unreachable locally. However, port scans will then be able to easily figure out that I am running
PostgreSQLon the standard port, presumably.
>
> Is there a way to run Postgre on some other non-standard port? Does it do well in this regard? How would i go about
doingthat?
>
> I know it won't "hack proof" anything really, just make it a bit more confusing for anyone doing port scans on my
machine.
>
> ideas?
>
>
> regards,
> dan
