title: How to switch https traffic from 1 web server to another one. IPTABLES issue
body: <p>Here is my configuration.
  I have varnish listening to port 80 and 2 web server (tomcat) on port 8080 and 8081 and https 4430 and 4431.</p>
  
  <p>HTTP traffic goes from varnish to 1 web server. When I need to upgrade my app, I shut down one tomcat, upgrade the code, restart and change the varnish configuration to go to the upgraded tomcat.</p>
  
  <p>I need to do the same for HTTP traffic. It's a small amount of traffic and I don't need caching, so I though I could just use iptables.</p>
  
  <p>So I added a rule like this:</p>
  
  <pre><code>iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 4430
  </code></pre>
  
  <p>and when I need to switch to the other tomcat, I do:</p>
  
  <pre><code>iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 4430 
  iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 4431 
  </code></pre>
  
  <p>It seemed to work but after I few days all the machine has connection problems. Varnish is not connecting to tomcat, dns lookup do not work, etc.</p>
  
  <p>I found in /var/log/messages thousands of:</p>
  
  <pre><code>Mar 27 10:04:15 ip-10-72-254-31 kernel: [2112599.753509] nf_conntrack: table full, dropping packet.
  </code></pre>
  
  <p>Shutting down iptables seems to work to fix the connection problems.</p>
  
  <p>So, can I use iptables in the way I'm using it?
  How can I prevent "table full, dropping packet" issue?
  What else can I use to redirect my https traffic?</p>