How to address three servers in DMZ always using the same port?
-
I have registered three websites on the Internet. In DMZ I have three web servers. Each server manages only one website.
In pfsense, however, I can manage the traffic of ports 80 and 443 on a single server.
How can I go about directing all websites to different servers without changing ports and using only the standard ports (80 and 443) on all servers?- domain1.tld to Server1
- domain2.tld to Server2
- web2.domain2.tld to Server3
Thanks in advance
-
Using IPv4 ?
Three sites, using the same (WAN) IP, all redirecting to the same LAN IP, same port ?
Easy : you can't.A NAT(PAT) maps one incoming port using a protocol to a specified destination port on a LAN (DMZ) type network.
You can not map incoming port 80 to DMZ IP1, DMZ IP2 and DMZ IP3.What you can do :
Make the web server multi homed. That is : the same DMZ IP hosts a web server - and the web server host 3 sites.Or : use the pfSznse HA proxy package.
-
If you're sharing a single IPv4 address, the only way I'm aware of is to examine the header to see what the target was. I don't know if pfsense can do that though.
Yet another reason to move to IPv6.
-
Learn how to use haproxy. The host header was invented 20 years ago for your use case. That is how you do it. Separate ip addresses are for other use cases.
-
@tsmalmbe said in How to address three servers in DMZ always using the same port?:
The host header was invented 20 years ago for your use case.
Yep, they knew he was going to be doing this all those years ago.
-
I have given an example, to make things simple.
There are actually more servers and multiple domains are allocated on top of them. Also, websites that use other ports are already properly addressed.
The problem is that I have to keep separate some servers with standard web ports.Can you explain to me in a few words why and how HAProxy or IPV6 could solve the problem for me?
Then I will go to study everything better.In the meantime, thanks for answering me.
-
Can you explain to me in a few words why and how HAProxy or IPV6 could solve the problem for me?
Then I will go to study everything better.IPv6 wouldn't use NAT, each server would be contactable via its IPv6 address or FQDN.
https://docs.netgate.com/pfsense/en/latest/packages/haproxy.html
http://www.haproxy.org
-
The problem with IPv6 in this scenario is it doesn't solve the problem for non IPv6 clients.
Yes some day when everyone is on IPv6, and ipv4 is thing of the past like netbeui or ipx, then sure you wouldn't have to worry about problems nat bring.
But currently trying to use IPv6 to solve this problem would just bring another problem - how do clients that do not have IPv6 access (which is a LOT) these sites.
In the current transition phase that the world is in towards IPv6, anybody with IPv6 either also has IPv4 or if their isp has only given them IPv6 the isp has put in a system to allow them to access IPv4 addresses.
But clients that only have IPv4 have no way to access a IPv6 address.
-
I am reading the documentation for HAProxy, but I am getting the impression that it is too complicated to solve this problem of mine.
I'm moving domains to one only Apache server and configuring the ones I can't move to use a different port.
Thanks everyone for the suggestions.
-
@whitetiger-it, and why not just virtualization? I could have everything I want as I want it ...!
-
@silence
Are you saying you can virtualize a public IPv4 IP address
I want the recipe ....Because virtualizing the servers wont solve the IP/Port (combo needs to be uniq) problem.
Apache (prob ngnix too), can parse the url passed , and "route internally" to the desired vServer that matches.
But OP already had multiple servers, what should virtualization help here ?
/Bingo
-
@silence
What virtualization do you mean?
The servers are virtualized in Proxmox.
Apache is installed on these servers with virtualization of multiple domains.I used to keep domains on different servers for security reasons because some have critical data and some other domains don't.
But at this point it seems to me that the solution is to force access with different ports. -
@whitetiger-it said in How to address three servers in DMZ always using the same port?:
HAProxy, but I am getting the impression that it is too complicated to solve this problem of mine.
If your not config file guy, then sure might be a steep learning curve your not really ready to tackle, and using different ports is a "easy" solution.
But pfsense puts a gui on haproxy. And it drastically reduces the learning curve and configuration minutia requirements.
There are many a user here using it similar fashion, serving up different services behind a reverse proxy and sending to different backends be it ip or port or combo of both. I run it myself for a couple of different sites allowing for use of 443 externally and sending them to just different ports on the same host behind pfsense.
-
@WhiteTiger-IT said in How to address three servers in DMZ always using the same port?:
But pfsense puts a gui on haproxy. And it drastically reduces the learning curve and configuration minutia requirements.
@WhiteTiger-IT just as john poz says !! I agree with him.
@whitetiger-it said in How to address three servers in DMZ always using the same port?:
The servers are virtualized in Proxmox.
yes
