Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How to address three servers in DMZ always using the same port?

    Firewalling
    8
    14
    1.4k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JKnottJ
      JKnott @WhiteTiger-IT
      last edited by

      @whitetiger-it

      If you're sharing a single IPv4 address, the only way I'm aware of is to examine the header to see what the target was. I don't know if pfsense can do that though.

      Yet another reason to move to IPv6.

      PfSense running on Qotom mini PC
      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
      UniFi AC-Lite access point

      I haven't lost my mind. It's around here...somewhere...

      1 Reply Last reply Reply Quote 0
      • T
        tsmalmbe @WhiteTiger-IT
        last edited by

        @whitetiger-it

        Learn how to use haproxy. The host header was invented 20 years ago for your use case. That is how you do it. Separate ip addresses are for other use cases.

        Security Consultant at Mint Security Ltd - www.mintsecurity.fi

        JKnottJ 1 Reply Last reply Reply Quote 0
        • JKnottJ
          JKnott @tsmalmbe
          last edited by

          @tsmalmbe said in How to address three servers in DMZ always using the same port?:

          The host header was invented 20 years ago for your use case.

          Yep, they knew he was going to be doing this all those years ago. 😉

          PfSense running on Qotom mini PC
          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
          UniFi AC-Lite access point

          I haven't lost my mind. It's around here...somewhere...

          1 Reply Last reply Reply Quote 0
          • W
            WhiteTiger-IT
            last edited by

            I have given an example, to make things simple.
            There are actually more servers and multiple domains are allocated on top of them. Also, websites that use other ports are already properly addressed.
            The problem is that I have to keep separate some servers with standard web ports.

            Can you explain to me in a few words why and how HAProxy or IPV6 could solve the problem for me?
            Then I will go to study everything better.

            In the meantime, thanks for answering me.

            NogBadTheBadN 1 Reply Last reply Reply Quote 0
            • NogBadTheBadN
              NogBadTheBad @WhiteTiger-IT
              last edited by NogBadTheBad

              @whitetiger-it

              Can you explain to me in a few words why and how HAProxy or IPV6 could solve the problem for me?
              Then I will go to study everything better.

              IPv6 wouldn't use NAT, each server would be contactable via its IPv6 address or FQDN.

              https://docs.netgate.com/pfsense/en/latest/packages/haproxy.html

              http://www.haproxy.org

              Andy

              1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

              johnpozJ 1 Reply Last reply Reply Quote 1
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @NogBadTheBad
                last edited by johnpoz

                The problem with IPv6 in this scenario is it doesn't solve the problem for non IPv6 clients.

                Yes some day when everyone is on IPv6, and ipv4 is thing of the past like netbeui or ipx, then sure you wouldn't have to worry about problems nat bring.

                But currently trying to use IPv6 to solve this problem would just bring another problem - how do clients that do not have IPv6 access (which is a LOT) these sites.

                In the current transition phase that the world is in towards IPv6, anybody with IPv6 either also has IPv4 or if their isp has only given them IPv6 the isp has put in a system to allow them to access IPv4 addresses.

                But clients that only have IPv4 have no way to access a IPv6 address.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                1 Reply Last reply Reply Quote 1
                • W
                  WhiteTiger-IT
                  last edited by

                  I am reading the documentation for HAProxy, but I am getting the impression that it is too complicated to solve this problem of mine.

                  I'm moving domains to one only Apache server and configuring the ones I can't move to use a different port.

                  Thanks everyone for the suggestions.

                  ? johnpozJ 2 Replies Last reply Reply Quote 0
                  • ?
                    A Former User @WhiteTiger-IT
                    last edited by

                    @whitetiger-it, and why not just virtualization? I could have everything I want as I want it ...!

                    bingo600B W 2 Replies Last reply Reply Quote 0
                    • bingo600B
                      bingo600 @A Former User
                      last edited by

                      @silence
                      Are you saying you can virtualize a public IPv4 IP address 😊
                      I want the recipe ....

                      Because virtualizing the servers wont solve the IP/Port (combo needs to be uniq) problem.

                      Apache (prob ngnix too), can parse the url passed , and "route internally" to the desired vServer that matches.

                      But OP already had multiple servers, what should virtualization help here ?

                      /Bingo

                      If you find my answer useful - Please give the post a 👍 - "thumbs up"

                      pfSense+ 23.05.1 (ZFS)

                      QOTOM-Q355G4 Quad Lan.
                      CPU  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                      LAN  : 4 x Intel 211, Disk  : 240G SAMSUNG MZ7L3240HCHQ SSD

                      1 Reply Last reply Reply Quote 0
                      • W
                        WhiteTiger-IT @A Former User
                        last edited by

                        @silence
                        What virtualization do you mean?
                        The servers are virtualized in Proxmox.
                        Apache is installed on these servers with virtualization of multiple domains.

                        I used to keep domains on different servers for security reasons because some have critical data and some other domains don't.
                        But at this point it seems to me that the solution is to force access with different ports.

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @WhiteTiger-IT
                          last edited by johnpoz

                          @whitetiger-it said in How to address three servers in DMZ always using the same port?:

                          HAProxy, but I am getting the impression that it is too complicated to solve this problem of mine.

                          If your not config file guy, then sure might be a steep learning curve your not really ready to tackle, and using different ports is a "easy" solution.

                          But pfsense puts a gui on haproxy. And it drastically reduces the learning curve and configuration minutia requirements.

                          There are many a user here using it similar fashion, serving up different services behind a reverse proxy and sending to different backends be it ip or port or combo of both. I run it myself for a couple of different sites allowing for use of 443 externally and sending them to just different ports on the same host behind pfsense.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                          ? 1 Reply Last reply Reply Quote 0
                          • ?
                            A Former User @johnpoz
                            last edited by

                            @WhiteTiger-IT said in How to address three servers in DMZ always using the same port?:

                            But pfsense puts a gui on haproxy. And it drastically reduces the learning curve and configuration minutia requirements.

                            @WhiteTiger-IT just as john poz says !! I agree with him.

                            @whitetiger-it said in How to address three servers in DMZ always using the same port?:

                            The servers are virtualized in Proxmox.

                            yes

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.