Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How to address three servers in DMZ always using the same port?

    Firewalling
    8
    14
    1.4k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • W
      WhiteTiger-IT
      last edited by

      I have registered three websites on the Internet. In DMZ I have three web servers. Each server manages only one website.
      In pfsense, however, I can manage the traffic of ports 80 and 443 on a single server.
      How can I go about directing all websites to different servers without changing ports and using only the standard ports (80 and 443) on all servers?

      • domain1.tld to Server1
      • domain2.tld to Server2
      • web2.domain2.tld to Server3

      Thanks in advance

      GertjanG JKnottJ T 3 Replies Last reply Reply Quote 0
      • GertjanG
        Gertjan @WhiteTiger-IT
        last edited by

        @whitetiger-it

        Using IPv4 ?
        Three sites, using the same (WAN) IP, all redirecting to the same LAN IP, same port ?
        Easy : you can't.

        A NAT(PAT) maps one incoming port using a protocol to a specified destination port on a LAN (DMZ) type network.
        You can not map incoming port 80 to DMZ IP1, DMZ IP2 and DMZ IP3.

        What you can do :
        Make the web server multi homed. That is : the same DMZ IP hosts a web server - and the web server host 3 sites.

        Or : use the pfSznse HA proxy package.

        No "help me" PM's please. Use the forum, the community will thank you.
        Edit : and where are the logs ??

        1 Reply Last reply Reply Quote 0
        • JKnottJ
          JKnott @WhiteTiger-IT
          last edited by

          @whitetiger-it

          If you're sharing a single IPv4 address, the only way I'm aware of is to examine the header to see what the target was. I don't know if pfsense can do that though.

          Yet another reason to move to IPv6.

          PfSense running on Qotom mini PC
          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
          UniFi AC-Lite access point

          I haven't lost my mind. It's around here...somewhere...

          1 Reply Last reply Reply Quote 0
          • T
            tsmalmbe @WhiteTiger-IT
            last edited by

            @whitetiger-it

            Learn how to use haproxy. The host header was invented 20 years ago for your use case. That is how you do it. Separate ip addresses are for other use cases.

            Security Consultant at Mint Security Ltd - www.mintsecurity.fi

            JKnottJ 1 Reply Last reply Reply Quote 0
            • JKnottJ
              JKnott @tsmalmbe
              last edited by

              @tsmalmbe said in How to address three servers in DMZ always using the same port?:

              The host header was invented 20 years ago for your use case.

              Yep, they knew he was going to be doing this all those years ago. 😉

              PfSense running on Qotom mini PC
              i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
              UniFi AC-Lite access point

              I haven't lost my mind. It's around here...somewhere...

              1 Reply Last reply Reply Quote 0
              • W
                WhiteTiger-IT
                last edited by

                I have given an example, to make things simple.
                There are actually more servers and multiple domains are allocated on top of them. Also, websites that use other ports are already properly addressed.
                The problem is that I have to keep separate some servers with standard web ports.

                Can you explain to me in a few words why and how HAProxy or IPV6 could solve the problem for me?
                Then I will go to study everything better.

                In the meantime, thanks for answering me.

                NogBadTheBadN 1 Reply Last reply Reply Quote 0
                • NogBadTheBadN
                  NogBadTheBad @WhiteTiger-IT
                  last edited by NogBadTheBad

                  @whitetiger-it

                  Can you explain to me in a few words why and how HAProxy or IPV6 could solve the problem for me?
                  Then I will go to study everything better.

                  IPv6 wouldn't use NAT, each server would be contactable via its IPv6 address or FQDN.

                  https://docs.netgate.com/pfsense/en/latest/packages/haproxy.html

                  http://www.haproxy.org

                  Andy

                  1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                  johnpozJ 1 Reply Last reply Reply Quote 1
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @NogBadTheBad
                    last edited by johnpoz

                    The problem with IPv6 in this scenario is it doesn't solve the problem for non IPv6 clients.

                    Yes some day when everyone is on IPv6, and ipv4 is thing of the past like netbeui or ipx, then sure you wouldn't have to worry about problems nat bring.

                    But currently trying to use IPv6 to solve this problem would just bring another problem - how do clients that do not have IPv6 access (which is a LOT) these sites.

                    In the current transition phase that the world is in towards IPv6, anybody with IPv6 either also has IPv4 or if their isp has only given them IPv6 the isp has put in a system to allow them to access IPv4 addresses.

                    But clients that only have IPv4 have no way to access a IPv6 address.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                    1 Reply Last reply Reply Quote 1
                    • W
                      WhiteTiger-IT
                      last edited by

                      I am reading the documentation for HAProxy, but I am getting the impression that it is too complicated to solve this problem of mine.

                      I'm moving domains to one only Apache server and configuring the ones I can't move to use a different port.

                      Thanks everyone for the suggestions.

                      ? johnpozJ 2 Replies Last reply Reply Quote 0
                      • ?
                        A Former User @WhiteTiger-IT
                        last edited by

                        @whitetiger-it, and why not just virtualization? I could have everything I want as I want it ...!

                        bingo600B W 2 Replies Last reply Reply Quote 0
                        • bingo600B
                          bingo600 @A Former User
                          last edited by

                          @silence
                          Are you saying you can virtualize a public IPv4 IP address 😊
                          I want the recipe ....

                          Because virtualizing the servers wont solve the IP/Port (combo needs to be uniq) problem.

                          Apache (prob ngnix too), can parse the url passed , and "route internally" to the desired vServer that matches.

                          But OP already had multiple servers, what should virtualization help here ?

                          /Bingo

                          If you find my answer useful - Please give the post a 👍 - "thumbs up"

                          pfSense+ 23.05.1 (ZFS)

                          QOTOM-Q355G4 Quad Lan.
                          CPU  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                          LAN  : 4 x Intel 211, Disk  : 240G SAMSUNG MZ7L3240HCHQ SSD

                          1 Reply Last reply Reply Quote 0
                          • W
                            WhiteTiger-IT @A Former User
                            last edited by

                            @silence
                            What virtualization do you mean?
                            The servers are virtualized in Proxmox.
                            Apache is installed on these servers with virtualization of multiple domains.

                            I used to keep domains on different servers for security reasons because some have critical data and some other domains don't.
                            But at this point it seems to me that the solution is to force access with different ports.

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @WhiteTiger-IT
                              last edited by johnpoz

                              @whitetiger-it said in How to address three servers in DMZ always using the same port?:

                              HAProxy, but I am getting the impression that it is too complicated to solve this problem of mine.

                              If your not config file guy, then sure might be a steep learning curve your not really ready to tackle, and using different ports is a "easy" solution.

                              But pfsense puts a gui on haproxy. And it drastically reduces the learning curve and configuration minutia requirements.

                              There are many a user here using it similar fashion, serving up different services behind a reverse proxy and sending to different backends be it ip or port or combo of both. I run it myself for a couple of different sites allowing for use of 443 externally and sending them to just different ports on the same host behind pfsense.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                              ? 1 Reply Last reply Reply Quote 0
                              • ?
                                A Former User @johnpoz
                                last edited by

                                @WhiteTiger-IT said in How to address three servers in DMZ always using the same port?:

                                But pfsense puts a gui on haproxy. And it drastically reduces the learning curve and configuration minutia requirements.

                                @WhiteTiger-IT just as john poz says !! I agree with him.

                                @whitetiger-it said in How to address three servers in DMZ always using the same port?:

                                The servers are virtualized in Proxmox.

                                yes

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.