David Pinn's questions

Background: I'm writing a web application that will be available to the world at large on a software-as-a-service basis. As input to my choosing a database platform, I've been reading up on 'NoSQL' databases like Cassandra, Riak, MongoDB, and Redis. Replication, sharding, and partitioning are prominent in the feature sets of all of these databases.

I'll end up choosing one of them and getting on with development, but what troubles me is whether I'll realistically be able to take advantage of all of that database sharding/distribution goodness in production.

I'm a one-man start-up with a production technology infrastructure consisting of one SliceHost slice running Centos. I don't ever expect to run my own server hardware. I just want to have a view now of the kind of server architecture I could move towards when my product becomes overwhelmingly successful. :-)

How do people set up clusters of servers to support their nifty NoSQL database distribution schemes in a VPS environment? In most (all?) cases, the database products expect to run on a private LAN, and therefore lack the authentication mechanisms you'd need to support clusters spanning the wild woolly Internet world. How does one establish a private LAN in 'the cloud'? Do VPS providers offer that kind of thing? SliceHost seems to offer private IP addresses, but those addresses are accessible by all of their customers; they are not restricted to one particular customer.

I recently set up Tomcat on Port 80 using instructions provided by Werner Puschitz. In essence, I had to execute these two iptables commands:

iptables -t nat -I PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080
iptables -t nat -I OUTPUT -p tcp --dport 80 -j REDIRECT --to-ports 8080

I achieved the goal in regard to Tomcat, but it screwed up some other things; for example, when I attempt to run `yum update yum', I get the following errors:

http://mirror.stanford.edu/yum/pub/centos/5.5/addons/x86_64/repodata/repomd.xml: [Errno 4] IOError: <urlopen error (111, 'Connection refused')>
Trying other mirror.
http://mirrors.adams.net/centos/5.5/addons/x86_64/repodata/repomd.xml: [Errno 4] IOError: <urlopen error (111, 'Connection refused')>
etc...

WGET fails in similar fashion.

I know that the iptables rules are to blame because removing them fixed the problem with YUM and WGET. So, why are those rules screwing up YUM and WGET? I'm guessing it's the OUTPUT rule, right? What does it actually do, and why is it necessary? Is that nasty side-effect avoidable?

I'm following some instructions for Installing Tomcat. They require me to add the following line to my iptables file:

-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 8080 --syn -j ACCEPT

Having carefully read the man page for iptables, I have learned what the parameters do, except for the first one.

What does -A RH-Lokkit-0-50-INPUT do, and can you confirm that it is sensible in this case?