How do I connect these points? (DNS Forwarder, Port Forwarding, Sub-domain)
-
Goal: For instance, I have 3 VMs serving different applications - Plex, ERP, Gallery3
192.168.1.100:3000 - plex
FQDN - plex.mydomain.com192.168.1.150:4000 - erp
FQDN - erp.mydomain.com192.168.1.200:5000 - gallery3
FQDN - gallery3.mydomain.comI want to point them to these three sub-domains:
Sub-domains
plex.mydomain.com
gallery3.mydomain.com
erp.mydomain.comQuestion: What is the proper implementation?
At the moment, this is what I have done but I'm not sure if this is the right way
#1 - In Domain Management (registrar)
Subdomain - IPAddress/URL - Record Type
plex - http://mydomain.com:3000 - URL Frame
erp - http://mydomain.com:4000 - URL Frame
gallery3 - http://mydomain.com:5000 - URL FrameThis works fine with devices not connected to pfsense but for those connected with pfsense, I cannot resolve them. DNS Forwarder is enabled. Below are the host mappings:
Host - Domain - IP
plex - mydomain.com - 192.168.1.100
erp - mydomain.com - 192.168.1.150
gallery3 - mydomain.com - 192.168.1.200Clients within pfsense cannot resolve the above applications until I supplement the port number and whatever subdirectory needed to point to the application. And this requires keeping a lot of records which could get very messy very quickly. What's the right way to do this? How does a hosting company do it? Thanks!
-
#1 - In Domain Management (registrar)
Subdomain - IPAddress/URL - Record Type
plex - http://mydomain.com:3000 - URL FrameWell because :port has NOTHING to do with dns.. These record types would be A if your going to point to an IP that you want to resolve. Only time you would put in any sort of url would be for a webhop sort of thing, or framed connection.. DNS has nothing to do with ports or even urls - that would be some sort of extra service the registrar might provide.
User resolve plex.mydomain.com to whatever your public IP address is.. You then allow what port they are going to to use for whatever service your hosting off that IP in NAT (port forwards) and or firewall rules.
-
I have a dynamic IP. I'm using Namecheap's Dyanamic DNS to auto update the A record. For some reasons it will only update one/first A record and not everything else. Therefore I must use a URL Frame redirect.
-
So your internal host machines are running these services on the obscure ports?
192.168.1.100:3000 - plex
I would expect the internal machines to be using the standard ports with the port forward translating that to an obscure port for external clients.
Steve
-
"I have a dynamic IP. I'm using Namecheap's Dyanamic DNS to auto update the A record. For some reasons it will only update one/first A record and not everything else"
And how many IPs do you have? Why would you need more than 1 name..
so host.dyndnsdomain.tld resolves to your PUBLICIP = done!! Why do you think you need host2, or hostthis.dyndnsdomain.tld when all you have is 1 IP address that they would all point to?
Its not like your using host headers to determine which private IP address you forward too your forwarding based on some port that your adding to the fqdn..
Look you have 1 Public IP right - then why do you feel you need different names for this 1 IP address. When your going to be adding :3000 :4000, :5000 etc.. to the fqdn anyway?
If I resolve box.something.tld to my public IP.. If I access http://box.something.tld that means port 80, so I forward port 80 to what private IP that I want to serve up http.. lets call it 192.168.1.100.. Now maybe my ssh server is on 192.168.1.200 – to the outside its still box.something.tld -- so if I use my ssh client to go to box.something.tld I hit my public IP of pfsense on 22.. So I forward 22 to my 192.168.1.200 device serving up ssh.
If I go to https://box.something.tld that is port 443 -- it can be forwarded to 192.168.1.150, etc. etc. etc..
DNS just resolve name to IP.. You only have 1 IP so at a loss to understand why you think you need more than 1 name? Now if you wanted to serve up say multiple websites like site1.something.tld and site2.something.tld all off port 80 then its a different story.
But sure if you want you can have ssh.something.tld point to your publicIP, while http.something.tld points to this same IP, and https.something.tld and ftp.something.tld and ssh.something.tld all point to your publicIP.. You just need to create more hosts on whatever dynamic dns service your using, and create the entries on pfsense to update them all.. But its kind of pointless if you ask me when you only have 1 public IP to work with anyway.
-
No, this is just an illustration so it's easier to identify the scenario. Everything can be mapped accordingly on the registrar for public access but how is it done internally? I want to make this as transparent as possible so that there's no need to remember which port is which application listening on, and user can just punch in plex.mydomain.com and be able to access it regardless of where the clients were connected to (pfsense, or from their phones)
-
These are all web servers right? Why aren't they just running on port 80 internally? In that situation you just enter the url internally and the dns overide applies.
It is possible to setup a reverse proxy that can use host headers to differentiate between internal servers.
Steve
-
"I have a dynamic IP. I'm using Namecheap's Dyanamic DNS to auto update the A record. For some reasons it will only update one/first A record and not everything else"
And how many IPs do you have? Why would you need more than 1 name..
so host.dyndnsdomain.tld resolves to your PUBLICIP = done!! Why do you think you need host2, or hostthis.dyndnsdomain.tld when all you have is 1 IP address that they would all point to?
Its not like your using host headers to determine which private IP address you forward too your forwarding based on some port that your adding to the fqdn..
Look you have 1 Public IP right - then why do you feel you need different names for this 1 IP address. When your going to be adding :3000 :4000, :5000 etc.. to the fqdn anyway?
If I resolve box.something.tld to my public IP.. If I access http://box.something.tld that means port 80, so I forward port 80 to what private IP that I want to serve up http.. lets call it 192.168.1.100.. Now maybe my ssh server is on 192.168.1.200 – to the outside its still box.something.tld -- so if I use my ssh client to go to box.something.tld I hit my public IP of pfsense on 22.. So I forward 22 to my 192.168.1.200 device serving up ssh.
If I go to https://box.something.tld that is port 443 -- it can be forwarded to 192.168.1.150, etc. etc. etc..
DNS just resolve name to IP.. You only have 1 IP so at a loss to understand why you think you need more than 1 name? Now if you wanted to serve up say multiple websites like site1.something.tld and site2.something.tld all off port 80 then its a different story.
But sure if you want you can have ssh.something.tld point to your publicIP, while http.something.tld points to this same IP, and https.something.tld and ftp.something.tld and ssh.something.tld all point to your publicIP.. You just need to create more hosts on whatever dynamic dns service your using, and create the entries on pfsense to update them all.. But its kind of pointless if you ask me when you only have 1 public IP to work with anyway.
Alright please bear with me.
-
mydomain.com is now updated with the A record (dynamically) through pfsense's dynamic dns, to namecheap.
-
I have multiple VMs serving multiple apps, listening on different ports. They all have the same domain but different hostname. The reason I do this is so that I can easily manage them and scale them accordingly.
-
Apps that listen to the same port, say 80, have been changed to listen to other ports to avoid conflict.
-
Lets say for example - owncloud, is hosted on a Vm with an ip of 192.169.1.100. It listens on 80, but it's now mapped to 8082. By default it can be accessed through this link - http://mydomain.com/owncloud
-
In NAT settings, I've forwarded Nat port 8082, and Dest port 8082
-
If I were to punch in http://mydomain.com/owncloud I could not access it. I would need to specific the port # http://mydomain.com:8082/owncloud
-
The above is inelegant and confusing because now I'd need to remember the port # of every application.
-
-
Do you have single VMs serving multiple apps? In your first post it appeared as though each app had it's own internal IP.
Steve
-
These are all web servers right? Why aren't they just running on port 80 internally? In that situation you just enter the url internally and the dns overide applies.
It is possible to setup a reverse proxy that can use host headers to differentiate between internal servers.
Steve
All these apps listen on port 80
Magento
Drupal
Gallery3
OwncloudThey share the same physical NIC in a VM host so I need to change the ports to something else for all of them to work at the same time. Is it possible to map port 80 to a different port? When I map http 80 to 8082, http://www.yougetsignal.com/tools/open-ports/ says the port is closed.
How do I go about setting up a reverse proxy in pfsense?
-
Do you have single VMs serving multiple apps? In your first post it appeared as though each app had it's own internal IP.
Steve
Yes that is correct. I have all of them in a VMware host, with ONE physical NIC. Each of them have different virtual NIC bridged to the physical NIC. Each of them were manually assigned a static ip from /etc/network/interfaces. I'll move them to a Xenserver once they are all setup properly.
-
If each app is served internally from a different IP address it doesn't matter if they all use port 80.
Steve
