Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NAT for the same ports to different LAN IPs

    Scheduled Pinned Locked Moved NAT
    15 Posts 6 Posters 1.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • kiokomanK
      kiokoman LAYER 8 @iulianteodor
      last edited by

      @iulianteodor
      no, you need to nat 80 and 443 to pfsense itself, haproxy will take care of the rest, no other NAT rules will be affected

      ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
      Please do not use chat/PM to ask for help
      we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
      Don't forget to Upvote with the 👍 button for any post you find to be helpful.

      iulianteodorI 1 Reply Last reply Reply Quote 0
      • A
        aduzsardi @iulianteodor
        last edited by

        @iulianteodor you will basically setup pfSense to act as a http proxy for your servers
        you can also create a third internal server and designate that to act as the internal http proxy

        1 Reply Last reply Reply Quote 0
        • V
          viragomann @iulianteodor
          last edited by

          @iulianteodor
          Yes, HAproxy is the way you can do this on pfSense.
          Another option is to run a proxy directly on one of your backend servers, so that it forwards traffic destined to the other.

          I run an Apache web server with some websites and run the proxy module on it to forward two other domains to different servers.
          The Apache proxy is quite simple to set up and does its job flawlessly.

          1 Reply Last reply Reply Quote 0
          • iulianteodorI
            iulianteodor @kiokoman
            last edited by

            @kiokoman
            I tried. I can't get them to go:
            One WAN IP to
            "mail.domain.com" - LAN IP 192.168.1.3 -> 80 and 443
            "www.domain.com" - LAN IP 192.168.1.4 -> 80 and 443
            The truth is that I have never used HAProxy and I can't even find a step by step tutorial exactly on this situation.
            Something escapes me and I don't know what.
            I appreciate any help!

            DerelictD 1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate @iulianteodor
              last edited by

              @iulianteodor You are looking to do something more complicated than just a port forward so it will require more study.

              This is probably a good place to start:

              https://www.youtube.com/results?search_query=haproxy+on+pfsense+

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • iulianteodorI
                iulianteodor
                last edited by

                @iulianteodor said in NAT for the same ports to different LAN IPs:

                192.168.1.4

                I managed to set it up but I have a problem.
                "mail.domain.com" - LAN IP 192.168.1.3 -> 80
                "www.domain.com" - LAN IP 192.168.1.4 -> 8080
                4 sites in the 192.168.1.4:8080 backend are simple html sites and one is with mysql database.
                The four html sites work for me to access, but in the fifth one with mysql I have the message:
                "503 Service Unavailable No server is available to handle this request."
                Where am I wrong or what should I do?
                alt text
                alt text
                alt text

                johnpozJ 1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @iulianteodor
                  last edited by

                  @iulianteodor said in NAT for the same ports to different LAN IPs:

                  503 Service Unavailable No server is available to handle this request.

                  I have seen 503 when the backend doesn't pass the health check. You could try changing it to basic or just off.. Does it work then?

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  iulianteodorI 1 Reply Last reply Reply Quote 0
                  • iulianteodorI
                    iulianteodor @johnpoz
                    last edited by iulianteodor

                    @johnpoz said in NAT for the same ports to different LAN IPs:

                    have seen 503 when the backend doesn't pass the health check. You could try changing it to basic or just off.. Does it work then?

                    By simply NAT on WAN on port 80 to 192.168.1.4 port 8080 works

                    On the same IP (192.168.1.4:8080) there are 4 more sites (simple html) that go through HAProxy only one has mysql database (XAMP with mysql))

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @iulianteodor
                      last edited by

                      @iulianteodor you posted up haproxy - assumed all connections were going through haproxy.

                      I have seen 503 errors in haproxy when the backend check fails.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      iulianteodorI 1 Reply Last reply Reply Quote 0
                      • iulianteodorI
                        iulianteodor @johnpoz
                        last edited by

                        @johnpoz
                        alt text

                        kiokomanK 1 Reply Last reply Reply Quote 0
                        • kiokomanK
                          kiokoman LAYER 8 @iulianteodor
                          last edited by

                          @iulianteodor

                          haproxy show 503 when it points to a non-existent backend server aka broken configuration

                          try with health check -> none anyway

                          Services / HAProxy / Settings
                          the last button is SHOW automatically generated configuration.
                          post that, hide sensitive data

                          ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                          Please do not use chat/PM to ask for help
                          we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                          Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                          iulianteodorI 1 Reply Last reply Reply Quote 0
                          • iulianteodorI
                            iulianteodor @kiokoman
                            last edited by

                            @kiokoman

                            Automaticaly generated, dont edit manually.

                            Generated on: 2022-06-03 22:53

                            global
                            maxconn 1000
                            stats socket /tmp/haproxy.socket level admin expose-fd listeners
                            uid 80
                            gid 80
                            nbproc 1
                            nbthread 1
                            hard-stop-after 15m
                            chroot /tmp/haproxy_chroot
                            daemon
                            server-state-file /tmp/haproxy_server_state

                            listen HAProxyLocalStats
                            bind 127.0.0.1:2200 name localstats
                            mode http
                            stats enable
                            stats admin if TRUE
                            stats show-legends
                            stats uri /haproxy/haproxy_stats.php?haproxystats=1
                            timeout client 5000
                            timeout connect 5000
                            timeout server 5000

                            frontend frontend80
                            bind xx.xx.xx.xx:80 name xx.xx.xx.xx:80
                            mode http
                            log global
                            option http-keep-alive
                            timeout client 30000
                            acl expressite var(txn.txnhost) -m beg -i www.expresxxxx.com
                            acl expresmail var(txn.txnhost) -m beg -i mail.expresxxxx.com
                            acl ramsite var(txn.txnhost) -m beg -i www.ramxxxx.ro
                            acl nappasite var(txn.txnhost) -m beg -i www.nappaxxxx.ro
                            acl emisite var(txn.txnhost) -m beg -i www.emimaragro.ro
                            acl expresrosite var(txn.txnhost) -m beg -i www.expresxxxx.ro
                            acl rammail var(txn.txnhost) -m beg -i mail.ramxxxx.ro
                            acl nappamail var(txn.txnhost) -m beg -i mail.nappaxxxx.ro
                            http-request set-var(txn.txnhost) hdr(host)
                            use_backend backend-http8080_ipvANY if expressite
                            use_backend backend-http80_ipvANY if expresmail
                            use_backend backend-http8080_ipvANY if ramsite
                            use_backend backend-http8080_ipvANY if nappasite
                            use_backend backend-http8080_ipvANY if emisite
                            use_backend backend-http8080_ipvANY if expresrosite
                            use_backend backend-http80_ipvANY if rammail
                            use_backend backend-http80_ipvANY if nappamail

                            backend backend-http8080_ipvANY
                            mode http
                            id 100
                            log global
                            option log-health-checks
                            timeout connect 30000
                            timeout server 30000
                            retries 3
                            option httpchk OPTIONS /
                            server website 192.168.1.4:8080 id 101 check inter 1000 weight 250

                            backend backend-http80_ipvANY
                            mode http
                            id 102
                            log global
                            timeout connect 30000
                            timeout server 30000
                            retries 3
                            option httpchk OPTIONS /
                            server webmail 192.168.1.3:80 id 103 check inter 1000

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.