Lighttpd run php from different host using mod_proxy / mod_fastcgi

Posted on in Categories High performance computing, Howto, lighttpd, Linux, UNIX last updated July 10, 2007

Lighttpd allows you to run php from different hosts. This is quite useful:

a] If you want to run php 4 locally and php 5 from remote host
b] Load balancing dynamic content
c] Added layer for security for chrooted jails etc

If you would like to run wikipedia / like site, you can use this technique. You can use mod_proxy or standard mod_fastcgi for this purpose.

How it works?

You need to use spawn-fcgi binary that spawns fastcgi processes. With spawn-fcgi you can bind php to particular port or unix-domain socket (little fast as compare to tcp port). It will take off some load from the webserver you have to control the FastCGI process by a external program like spawn-fcgi.

For example following command uses unix-domain to launch fastcgi process:
spawn-fcgi -s /tmp/php-fastcgi.sock -f /usr/bin/php-cgi -u lighttpd -g lighttpd -C 5 -P /var/run/

This one bind itself to TCP port 8081
spawn-fcgi -p 8081 -a -f /usr/bin/php-cgi -u lighttpd -g lighttpd -C 5 -P /var/run/


  • -f {fcgiapp} filename of the fcgi-application, e.g php – /usr/bin/php-cgi
  • -a {addr} : bind to ip address
  • -p {port} : bind to tcp-port
  • -s {path} : bind to unix-domain socket
  • -C {childs} : (PHP only) numbers of childs to spawn (default 5)
  • -P {path} : name of PID-file for spawed process, so that we can kill process later on
  • -n : no fork (for daemontools)
  • -c {dir} : chroot to directory
  • -u {user} : change to user-id
  • -g {group} : change to group-id

Using mod_proxy / mod_fastcgi, we can process everything on or cluster of php servers:

Web server <----> php-request <----> PHP listing on 

A php / ruby / java app cluster server:

Web server <----> php-request <----> // PHP listing on 
                              // PHP listing on  
                             // PHP listing on 

Task: Run php from and 8081 port

Make sure you copy spawn-fcgi file to, now enter following command:
# spawn-fcgi -p 8081 -a -f /usr/bin/php-cgi -u lighttpd -g lighttpd -C 10 -P /var/run/
Make sure firewall is not blocking access to

Now open ligttpd.conf on other host and enter mod_fastcgi as config as follows:

fastcgi.server = ( ".php" =>
       "host" => "",
       "port" => 8081

Save and close the file. Restart lighttpd:
# /etc/init.d/lighttpd restart

You can use mod_proxy configuration as follows, if one of the hosts goes down the all requests for this one server are moved equally to the other servers.

$HTTP["host"] == "" {
  proxy.balance = "hash"
  proxy.server  = ( "" => ( ( "host" => "","port" => 8080  ),
                            ( "host" => "" ,"port" => 8080),
                            ( "host" => "" ,"port" => 8080),
                            ( "host" => "" ,"port" => 8080),
                            ( "host" => "" ,"port" => 8080) ) )

This is just an introduction, feel free to explore mod_proxy documentation for more information.

Linux: Iptables Allow MYSQL server incoming request on port 3306

Posted on in Categories Howto, Iptables, Linux, MySQL, Security, Tips last updated November 20, 2015

MySQL database is a popular for web applications and acts as the database component of the LAMP, MAMP, and WAMP platforms. Its popularity as a web application is closely tied to the popularity of PHP, which is often combined with MySQL. MySQL is open source database server and by default it listen on TCP port 3306. In this tutorial you will learn how to open TCP port # 3306 using iptables command line tool on Linux operating system.

Linux Iptables: How to block or open mail server / SMTP protocol

Posted on in Categories CentOS, Debian Linux, Iptables, Linux, Networking, RedHat/Fedora Linux, Security last updated November 12, 2007

SMTP is used to send mail. Sendmail, Qmail, Postfix, Exim etc all are used on Linux as mail server. Mail server uses the TCP port 25. Following two iptable rule allows incoming SMTP request on port 25 for server IP address (open port 25):
iptables -A INPUT -p tcp -s 0/0 –sport 1024:65535 -d –dport 25 -m state –state NEW,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -p tcp -s –sport 25 -d 0/0 –dport 1024:65535 -m state –state ESTABLISHED -j ACCEPT

In order to block port 25 simply use target REJECT instead of ACCEPT in above rules.

And following two iptables rules allows outgoing SMTP server request for server IP address
iptables -A OUTPUT -p tcp -s –sport 1024:65535 -d 0/0 –dport 25 -m state –state NEW,ESTABLISHED -j ACCEPT

iptables -A INPUT -p tcp -s 0/0 –sport 25 -d –dport 1024:65535 -m state –state ESTABLISHED -j ACCEPT