Newsroom Update
Beginning in May, a special Today at Apple series titled “Made for Business” will offer small business owners and entrepreneurs free opportunities to learn how Apple products and services can support their growth and success. Learn more >
Beginning in May, a special Today at Apple series titled “Made for Business” will offer small business owners and entrepreneurs free opportunities to learn how Apple products and services can support their growth and success. Learn more >
According to the Apple documentation, to use the caching server, all clients need to share the same public address via nat. On my network with many macs, this would appear to make the caching service useless, as we have multiple public addresses to which our clients are nat'ed (a full class C, to be exact). Is there anyway around this restriction, or am I simply going to be unable to use what looks like it would be a highly usefull service?
As it stands, you are correct, with some minor caveats...
When the Caching Server starts up (and periodically while it's running), it checks in with Apple, and Apple tracks the public IP address of your server.
When a client checks for updates, Apple cross-reference the client's IP address with the list of known caching servers. If it finds one it redirects the client to their local cache server.
Since this mechanism is transparent - there's no configuration or interaction on the user's part, the IP address has to match since there's no other way for Apple to know if the caching server is on the same local network as the client (even IP addresses just one or two digits off could be entirely separate networks).
In your case, if you're using a pool of NAT addresses your benefit of this service is severely restricted.
There are two options that I can see, though.
One is to set a custom NAT rule (assuming your firewall supports it) so that all connections to Apple's update server are NATted via the same address.
The other is to run your own Software Update Server. However, this only caches OS updates, not App Store updates, and requires configuration on each client, so you do miss some of the advantages of the Caching Service.
So If we can set up the firewall NAT rule, we can get away with just 1 caching server (unless of course it gets overloaded and we need another).
The OP's original problem was that one server for multiple locations wasn't viable since it would overload the WAN links between the hub and each location. This may or may not be an issue for you, depending on your network topology, but it's something to consider.
So does anyone have the information needed to create a custom NAT in the firewall?
No one here can answer that for you since we don't know what router/firewall you're using.
You may be thinking of using the firewall built-in to Mac OS X, but this will not be appropriate here. You need to look at whatever device is performing NAT at your network edge. I highly doubt that's a Mac OS X Server.
Overloading the WAN links shouldn't be a problem. The only problem I could see is that we are running this on a Mac Mini and I could see that getting overloaded. So having additional ones to share the load may be needed.
As far as the custom NAT rule, I'm not looking for directions or anything (and I'm not the firewall guy here). I'm looking for the information such as URLs, IPs, ports, etc that we would need to create a rule. I'm assuming we could set a rule saying any traffic going to these locations uses this public IP. If I can get this information, I can give it to our firewall guy and see what he can do with it.
Thanks!
Does anyone ever answer a question without a question in these forums? Can anyone point to a white paper, or design guide to use this? Servicing over 35,000 in a school district, it is not even an option to have one outbound address when we are multi homed (mulitiple ISP providers) So if I want to direct all of my traffic down one pipe to Apple represented by one ip address... what is the address range I would create the rule with? Searching Apple support I can find no design guides or references... just a bunch of people chiming in with more problems.
I contacted Apple to ask them about the IP addresses I would need and they pointed me here: http://support.apple.com/kb/ht3923 They said it would be the same addresses for the caching server. So we created a rule with those as the destination and it didin't do anything.
Apple owns the entire 17.0.0.0/8 range. So we tested a rule by saying any traffic going to 17.0.0.0/8 will get a specific external IP, which is the same external IP as the caching server. That worked great. But we would really like to be able to narrow it down to more specific IP addresses. However, as we monitor a device going out to get updates, we seem to get different IP addresses every time.
After testing the last few hours, I found that the network of 17.173.66.0/24 seems to be Apple's update servers for apps. So I've created a rule and have apps from 3 of our schools caching now.
This is exactly what we want to do, but I'm not sure what needs to be done or even what to google to get it done. What changes exactly did you need to make in your firewall? What kind of firewall are you working with?
Hi Nathan,
We are using a Checkpoint firewall. Here's what we did:
So basically we just wanted to create a rule to make any traffic from our test sites to 17.173.66.0/24 use the same external IP as the Apple Cache Server. As long as the external IP is the same, the information gets cached. Eventually I belive we'll be removing the group of 3 sites and just cache all sites on our network (so the Original Packet Source would just be Any).
Hope this helps!
-Logan
Very helpful. Thanks very much!
By the way, in the OS X Server 4.0 Developer Preview notes, it appears caching server will support multiple public IPs.
Caching Server
• IP address range registration to support caching content in non-NAT’ed networks.
After playing with caching server in Server 4.0 I don't think this is the case. From what I can tell it supports the following configurations:
1. Supporting clients that NAT to the same public IP as the caching server.
2. Supporting clients that don't NAT at all, and instead are issued public IPs directly. A DNS record is required for these internal clients (using public IPs) to find the caching server.
It still doesn't support the scenario we want, which is internal clients that NAT to a different public IP than the caching server. Or if it does, I can't figure out how to make it work and the documentation does not spell out this scenario like it does the others.
We also have an engineering ticket opened and are having Apple's engineers review this. I tested the same thing as you mentioned it did not work for us either.
Who assigns public ip addresses directly to workstations anymore?
I would like to bump up this topic now after one year and Server 5 being released apparently with the same limitations.
Cross-link to another related topic: Re: How do I create a TXT record?
Enlightenment anywhere?
I think the question was solved in the above-mentioned Topic.
Caching services work with multiple IP addresses, regardless of NAT or no NAT
Use caching server with multiple public Addresses?
