Single hostname without port forwarding (PAT)?
-
Hi all,
although its more a general IPv6 than a pfsense question, maybe you could help me cutting the knot in my head.
Today, I have two services HTTP and SSH, reachable under the same public IPv4 and the same public hostname. Behind a PAT on pfsense, two different hosts serve them internally, one being the HTTP proxy in the DMZ, the other being a separated shell playground. (There are a handful of other services following the same pattern)
How do I transfer such a setup to the IPv4+IPv6 world, if I need/want to keep both services reachable under the same public hostname? I’m ok to assign routable IPv6s to the internal hosts and do the routing all the non-“evil” way (i.e. without PAT). But if each internal host/service has its own IPv6, how do I consolidate them under the same public hostname?
What is the IPv6 equivalent for the well-known ports + PAT4 so that my users do not have to do deal with a hostname per service? DNS SRV records come up to my mind, but they are not fully adopted: SSH clients, for example, do not query them.
Thanks
Martin -
But if each internal host/service has its own IPv6, how do I consolidate them under the same public hostname?
I think the answer is you don't. The absence of PAT will destroy the ability to have multiple hosts/services hiding behind a single IP address. Users might have to get used to the idea of each host being individually addressable - which is a good thing.
-
Was afraid of this answer. Yes, it´s a good thing - for me the admin. Not sure, my users will appreciate as much as I do.
Thanks
Martin
